Multi-Flow Hybrid Task Offloading Scheme for Multimodal High-Load V2I Services

Abstract

In the Internet of Vehicles (IoV), connected vehicles generate high-load perception tasks with large-scale and multimodal sensitive data, imposing strict requirements on latency, computing, and privacy. Existing solutions still suffer from high task service latency and privacy risks. To address these issues, this paper proposes an integrated framework that jointly considers multi-flow task offloading, adaptive privacy preservation, and latency-aware resource incentive mechanism. Specifically, we propose a Location-Aware and Trust-based (LA-Trust) dual-node task offloading algorithm based on deep reinforcement learning (DRL), which treats pre-partitioned subtasks as multiple parallel flows and enables flow-level collaborative offloading optimization across neighboring nodes, allows subtask data uploading and processing to proceed concurrently, and incorporates node security into decision making. To further enhance privacy protection, a Distribution-Aware Local Differential Privacy (DA-LDP) algorithm is designed to adaptively inject artificial noise according to data heterogeneity, balancing privacy protection and task execution accuracy. In addition, a Delay-Cost Reverse Auction (DC-RA) algorithm is proposed to further reduce latency by introducing wireless channel modeling between idle vehicles and edge nodes into the incentive mechanism. Experimental results show that the proposed framework improves task execution accuracy by 38% and reduces offloading cost, delay, incentive cost, and auction communication latency by 64.41%, 64.64%, 19%, and 44%, respectively, while more than 60% of tasks are offloaded to high-trust nodes.

1. Introduction

With the development of intelligent transportation systems, vehicles continuously generate numerous perception tasks, such as target tracking, motion prediction, and risk assessment, which rely on vehicle-to-infrastructure (V2I) services and impose high demands on computing capability. Recent studies indicate that an autonomous vehicle can generate up to 1 TB of multimodal data per hour [1], produced by onboard sensors such as LiDAR, millimeter-wave radar, cameras, and GPS modules. Among these, LiDAR generates approximately 10–70 MB of point cloud data per second [2]. High-frequency GPS produces tens of KB per second of vehicle trajectory data [1]. In single-vehicle multimodal perception tasks, a perception cycle often requires the fusion of multiple frames from LiDAR and cameras. Each LiDAR frame usually contains about 1.2 MB of point cloud data. Each RGB image frame is about 3 MB in size. As a result, the total data volume of one perception cycle can easily reach tens of MB [3]. In cooperative vehicle-to-everything perception scenarios, data from nearby vehicles or roadside units further increases the data size of each perception cycle. In addition, Wang [4] reports that camera-based 3D detection models incur single-frame inference delays exceeding 300 ms, which is impractical for autonomous driving, as perception tasks such as collision detection typically require responses within 50–100 ms.

These massive and heterogeneous data support intelligent transportation systems. However, they also introduce two major challenges: high task service latency and increased privacy risks.

First, perception tasks are regarded as high-load tasks with large data volumes and strict latency and accuracy requirements. Due to limited onboard computation, storage, and energy resources, vehicles cannot process such tasks independently, and many existing offloading methods fail to meet the stringent response-time requirements. Second, perception data is highly sensitive, and wireless offloading exposes it to significant privacy risks. Traditional privacy methods that add fixed-intensity noise are unsuitable for multimodal and heterogeneous data, as different data types require varying protection levels. Applying uniform noise can degrade data utility and impair task performance. Third, in the Internet of Vehicles (IoV) environment, multiple vehicles compete for limited computing resources at edge nodes. Auction-based methods are commonly used to leverage idle vehicle resources, but most existing algorithms focus primarily on minimizing bidding costs and neglect communication latency. This limitation can degrade the overall response performance of perception tasks.

In summary, in dynamic and dense IoV environments, traditional methods cannot address both latency and privacy issues in high-load perception tasks at the same time. A more effective, efficient, and secure task offloading solution is required to overcome these challenges.

1.1. Related Work

1.1.1. Reinforcement Learning-Based Task Offloading

In recent studies, reinforcement learning (RL) has been widely applied to vehicle task offloading. For edge node offloading, Zhao et al. [5], Zhou et al. [6], and Cha et al. [7] considered vehicle mobility and applied RL to improve task response time and mitigate computing resource constraints. Zhang et al. [8] and Ahmadi et al. [9] studied task offloading in mobile edge computing under a non-orthogonal multiple access (NOMA) framework, using RL to solve non-convex offloading and resource allocation problems. Yakubu et al. [10] combined RL with a Markov decision process (MDP) to address task offloading. Xue et al. [11] integrated sensing and communication (ISAC) technology with deep reinforcement learning (DRL) to enhance the adaptability of task offloading strategies. For hybrid offloading, Jiang et al. [12], Chen et al. [13], and Mohanapriya et al. [14] combined game-theoretic methods and RL to optimize offloading strategies and improve quality of service (QoS). Liu et al. [15] proposed a DRL-based hybrid task offloading and resource allocation scheme that adapts to vehicle mobility and varying channel conditions, reducing latency and energy consumption. For platoon-assisted offloading, Chen et al. [16] proposed a DRL framework using DDPG to jointly optimize task offloading and radio resource allocation, deciding whether tasks are processed within the platoon or at roadside edge servers. Similarly, Wu et al. [17] studied fog-assisted platoons and proposed an offloading strategy for insufficient intra-platoon resources, demonstrating the feasibility of joint Vehicle-to-Vehicle (V2V) and V2I offloading. Moreover, recent work [18] proposed a task splitting scheme where subtasks are processed by nearby vehicles or MEC servers, which improves delay under dynamic network conditions. However, most existing methods rely on a single-flow offloading strategy. Tasks are sent to only one node and multi-node cooperation is not considered. In high-load scenarios, this limitation often leads to lower offloading efficiency instead of performance gains.

1.1.2. Privacy-Preserving Techniques in Vehicular Networks

Researchers have proposed various privacy-preserving methods. For example, Pan et al. [19], Zhou et al. [20], and Yao et al. [21] designed data-sharing mechanisms for IoV networks. Their goal was to ensure data confidentiality, maintain security during sharing, and prevent unauthorized access. Ibrahim et al. [22] proposed replicating authentication services to trusted vehicles to improve availability and reliability during RSU failures or congestion in IoV networks. Dwork et al. [23] and Firdaus et al. [24,25] developed differential privacy (DP) and local differential privacy (LDP) methods. These algorithms add noise to original data, allowing feature sharing without exposing raw data. Xia et al. [26] combined LDP and DRL to build a privacy-preserving distributed learning framework to enhance data security. However, most existing algorithms are computationally complex and unsuitable for resource-constrained vehicles. In addition, these methods generally process all data identically. This uniform approach is not suitable for modern multimodal and heterogeneous data. It often distorts data features and reduces task execution accuracy.

1.1.3. Incentive Mechanisms for Idle Resource Utilization

To reduce the computational burden on edge nodes, researchers have applied game-theoretic models, contract mechanisms, and auction-based algorithms to improve resource utilization. For example, Li et al. [27] and Le et al. [28] used Stackelberg game theory and contract mechanisms to design a multi-stage incentive scheme that maximizes the benefits of multiple participants. Liwang et al. [29] and Liu et al. [30] designed an auction mechanism based on the Vickrey–Clarke–Groves (VCG) model to improve the utilization of idle resources while ensuring fairness and efficiency. Pu et al. [31] designed an auction to encourage idle users to provide resources despite battery limitations. Zhang et al. [32] combined auction methods with optimization algorithms to improve resource allocation. However, these approaches often ignore communication latency during resource incentives, which increases the overall task service time and reduces the feasibility of offloading strategies.

1.2. Contributions of Our Work

In this paper, we propose an integrated framework that jointly addresses high service latency and privacy risks in high-load IoV perception tasks by combining multi-flow task offloading, adaptive privacy preservation, and latency-aware resource incentive mechanism. First, the Location-Aware and Trust-based (LA-Trust) algorithm considers vehicle location and node trust probability, using dual nodes for multi-flow task offloading to optimize task service time and completion rate while ensuring secure offloading. Second, the Distribution-Aware Local Differential Privacy (DA-LDP) algorithm adapts to multimodal heterogeneous data by analyzing density and structural differences, allowing adaptive noise injection to protect data security and maintain data utility. Finally, the Delay-Cost Reverse Auction (DC-RA) algorithm models the wireless channel between vehicles and edge nodes and constructs a weighted incentive function that jointly considers incentive cost and communication latency. The key contributions of this paper are:

• We formulate a joint optimization modeling approach for high-load perception tasks in IoV, focusing on reducing task service latency and enhancing privacy protection, and decompose the overall objective into two subproblems that are addressed by the algorithms proposed in this paper.
• We design the LA-Trust algorithm, a dual-node task offloading scheme built on DRL. It is developed on top of the conventional multi-agent deep deterministic policy gradient (MADDPG) framework, treating the partitioned subtasks as parallel flows, allowing concurrent uploading and processing across neighboring nodes, and incorporates node security into offloading decisions. This mechanism reduces latency and enhances offloading security compared with conventional MADDPG offloading algorithms.
• We propose the DA-LDP algorithm, which leverages the Randomized Response (RR) mechanism to select perturbed data and applies Gaussian noise, and adaptively adjusts the perturbation level according to data heterogeneity. The design preserves formal privacy guarantees while mitigating the impact of data perturbation on task execution accuracy, outperforming traditional fixed-noise approaches in task execution accuracy.
• We develop the DC-RA algorithm, which builds upon conventional cost-minimization resource auction mechanisms and incorporates data transmission latency into the optimization function. By assigning higher rewards to idle vehicles closer to the edge node, the algorithm reduces communication latency, achieving better performance than conventional bidding schemes.

Existing studies typically employ single-flow offloading and often neglect the impact of data transmission delay during resource incentive allocation. Similarly, when privacy preservation is incorporated, the reliability of execution nodes and data heterogeneity are often not taken into consideration. In contrast, the contributions presented above effectively mitigate these limitations, as demonstrated in our experimental results.

The remainder of this paper is organized as follows. Section 2 introduces the system model. Section 3 presents the overall optimization problem of the framework and its solution. Section 4 describes the design of the LA-Trust algorithm. Section 5 details the design of the DA-LDP algorithm. Section 6 explains the design of the DC-RA algorithm. Section 7 presents experimental results and discussion. Finally, Section 8 concludes the paper.

2. System Model

Table 1. Summary of main notations.

Notations	Descriptions
T	Set of discrete time slots
E	Set of edge nodes
B	Set of busy vehicles
S	Set of idle vehicles
$J_s$	Bid submitted by idle vehicle s
$K_b^t$	Task of busy vehicle b at time t
$q_s$	Unit price of resources supplied by vehicle s
$u_s$	Amount of resources supplied by vehicle s
$di{s}_s$	Distance between edge node and vehicle s
d	Task data size
c	Number of CPU cycles required to process one bit of data
$t_k$	Task deadline
$p_{r,j}$	Tendency of achieving high completion rates for trust state $H_e^j$
${\lambda }_j$	Expected number of abnormal events under trust state $H_e^j$
$a_b^i$	Offloading decision of vehicle b’s i-th subtask
$r_b^i$	Offloading ratio of subtask i of vehicle b
$e_b^i$	Selected target edge node for subtask i of vehicle b
$S^t$	System state at time t
$A^t$	Task offloading decisions at time t
$R^t$	System reward at time t
C	Resources required by the edge node
$C_e$	Resources purchased by the edge node

summarizes the main notations used in this paper. As shown in Figure 1, the proposed framework consists of three key modules: task offloading, privacy preservation, and resource incentive, which jointly address two main challenges: high task service latency and privacy risks. The task offloading module reduces service latency and mitigates privacy risks through dual-node cooperation and considering node trustworthiness. The privacy preservation module protects sensitive vehicle data via local perturbation before offloading. The resource auction module further reduces latency by incorporating wireless channel modeling.

Specifically, moving vehicles continuously generate high-load tasks. These vehicles are defined as the busy vehicle set B = $\{1,\dots ,b,\dots ,B\}$, where b represents the vehicle index and B is the total number of busy vehicles. Edge nodes with communication and computing capabilities are deployed along both sides of the road and are denoted as set E = $\{1,\dots ,e,\dots ,E\}$, where e represents the edge node index and E is the total number of edge nodes. The LA-Trust algorithm is deployed at edge nodes and is responsible for generating task offloading strategies. We assume that a busy vehicle moves at a constant velocity v along a straight trajectory from edge node 1 to edge node 2. Each task is assumed to be completed within the coverage range of at most two edge nodes.

The coverage range of each edge node is modeled as a circular region with diameter L. Adjacent edge nodes partially overlap in coverage. The coverage boundary of a node is set as the coordinate origin $(0,0)$, and the vehicle position is denoted as $(l,0)$. Time is divided into discrete slots, represented by the set T = $\{1,\dots ,t,\dots ,T\}$, where T is the total number of time slots. A busy vehicle b generates a divisible task $K_b^t$ at time t. Each task is characterized by data size d, required CPU cycles per bit c, deadline $t_k$, and subtask dependency $o_r$. Thus, the task is denoted as $K_b^t$ = {d, c, $t_k$, $o_r$}. Existing task partitioning methods such as [33] are adopted to divide each task into several related and unequal subtasks. The refined task parameters are expressed as $d=\{d_1,\dots ,d_i,\dots ,d_n\}$, $c=\{c_1,\dots ,c_i,\dots ,c_n\}$, and $t_k=\{t_{k1},\dots ,t_{ki},\dots ,t_{kn}\}$. Through V2I communication, edge nodes obtain vehicle state information, including velocity v and position l. When an offloading request is received, the network state is assumed to remain static within the decision slot. The residence time of a vehicle within the coverage of an edge node is $T_{stay}=\frac{L-l}{v}$. The distance between the vehicle and edge node e is given by $Di{s}_e=\sqrt{H_e^2+O_e^2}$, where $H_e$ is the height of edge node e and $O_e$ is the horizontal distance between the vehicle and node e [34]. Each edge node evaluates its trust probability using Bayesian inference and Dempster-Shafer theory (DST). Based on trust probabilities, vehicle information, and task parameters, the edge node determines the offloading strategy. The available strategies include processing tasks locally, offloading tasks to a single edge node, offloading tasks to two neighboring edge nodes, or collaborative processing between the vehicle and a single edge node.

The privacy preservation module applies the DA-LDP algorithm to locally perturb sensitive vehicle data. It adaptively adds Gaussian noise based on the density and structural differences of multimodal heterogeneous data.

Finally, vehicles with idle resources are defined as the idle vehicle set S = $\{1,\dots ,s,\dots ,S\}$, where s denotes the vehicle index and S is the total number of idle vehicles. These vehicles participate in a resource auction managed by the edge node. Each idle vehicle submits a bid $J_s$ = $\{q_s,u_s,di{s}_s\}$, including the unit resource price, the amount of provided resources, and the distance to the edge node. The resource trading process is communication-latency-aware, and the edge node selects idle vehicles based on bid information to reduce the overall task service latency.

Modeling Assumptions and Applicability

The assumptions that vehicles move at a constant speed along a straight path and that each task is executed within the coverage range of at most two adjacent edge nodes are widely used in vehicular edge computing studies. These assumptions are mainly adopted to ensure analytical tractability [35,36,37,38,39]. Despite their simplicity, they still allow the model to be extended to more complex and realistic scenarios.

First, in complex urban road networks with curved lanes and intersections, a vehicle’s long-term trajectory can be decomposed into a sequence of short linear segments. Since offloading decisions are made within short time intervals, and maneuvers such as frequent starts and stops, lane changes, and traffic light waiting typically occur on a longer time scale than the end-to-end task offloading process, vehicle motion within each interval can be well approximated by linear movement with nearly constant speed. This piecewise linear modeling approach preserves analytical simplicity while remaining consistent with real vehicular mobility behavior.

To further evaluate the sensitivity of dwell time to abrupt vehicle dynamics within a short control cycle, a worst-case perturbation analysis is presented under the assumption that the task’s latest possible completion occurs exactly at the boundary of the coverage area. The predicted dwell time is given by $T_{\mathrm{stay}}=\frac{L-l}{v}$, where v and l are obtained via V2I state reporting at the beginning of each decision slot, and the network state is assumed to remain constant within the slot. Assume that within a decision slot of duration t, the vehicle experiences acceleration a. The maximum displacement deviation is given by $\mathsf{\Delta }x=\frac{1}{2}a{t}^2$, and the corresponding velocity deviation is $\mathsf{\Delta }v=at$. Thus, the relative perturbation of dwell time satisfies $\frac{\mathsf{\Delta }{T}_{\mathrm{stay}}}{T_{\mathrm{stay}}}\approx \frac{at}{v}$. Under a conservative configuration representative of extreme emergency maneuvers ($v=30$ m/s, $a=8$ m/s², $t=0.1$ s), the maximum displacement deviation is $\mathsf{\Delta }x=0.04$ m, and the relative dwell-time perturbation is bounded by $2.7\%$. Under these conditions, the offloading strategy would fail only if the vehicle is located within a narrow boundary region near the edge of the coverage area and experiences a large acceleration toward the boundary, resulting in a significant change in velocity. Considering the coverage range of practical edge nodes, typical task requirements, and realistic vehicle acceleration limits, the likelihood of the vehicle falling exactly within this critical boundary region is extremely low. These constraints make the scenario in which the offloading strategy fails occur with low probability. Since the perturbation term is proportional to $t^2$ and the vehicle state is refreshed at each decision slot, the deviation remains strictly bounded and does not accumulate over time, preventing catastrophic amplification of dwell time or distance estimation errors.

Second, although practical deployments may include irregular edge node layouts or overlapping coverage from multiple nodes, the dual-node assumption serves as a common and manageable modeling abstraction rather than a strict system limitation. More importantly, the proposed framework is not inherently restricted to two edge nodes. The task offloading strategy, privacy preservation mechanism, and reverse auction module do not depend on a fixed number of candidate edge nodes. When more edge nodes are available within the coverage area, the framework can be naturally extended by enlarging the action space without changing the core algorithm design. The scalability to multi-node scenarios is further discussed in Section 4.

3. Problem Formulation and Solution Approach

This section formulates a joint optimization problem for high-load tasks in the IoV environment. The objective is to reduce task service latency while enhancing privacy protection. We then explain how the three proposed algorithms jointly address these objectives.

3.1. Joint Optimization Problem

Conceptually, the joint optimization goal is to minimize task service latency and maximize privacy protection. This objective can be abstractly formulated as:

$$U_{\mathrm{system}}=-T_{\mathrm{latency}}+P_{\mathrm{privacy}},$$

where $T_{\mathrm{latency}}$ represents the total task service latency and $P_{\mathrm{privacy}}$ denotes the overall privacy protection.

3.2. Optimization Problem Decomposition

The joint optimization problem is decomposed into two subproblems:

• Task Service Latency Minimization: This subproblem aims to reduce $T_{\mathrm{latency}}$ by efficiently scheduling and executing tasks across edge nodes, as well as by minimizing the communication latency incurred during the idle resource auction. This objective is collaboratively addressed by:
  • LA-Trust: A dual-node task offloading algorithm based on a DRL framework. It reduces offloading delay by enabling parallel processing of task uploading and execution.
  • DC-RA: A reverse auction based incentive mechanism. It reduces data transmission latency by incorporating the physical distance between edge nodes and idle vehicles into the incentive function.
  Since these two latency components occur sequentially and are independent, their sum provides a reasonable approximation of the total system latency:

  $$T_{\mathrm{latency}}=f_{\mathrm{LA}\text{-}\mathrm{Trust}}\left(Z\right)+f_{\mathrm{DC}\text{-}\mathrm{RA}}\left(T_{tx}\right),$$

  where Z and $T_{tx}$ denote the latency components computed by the LA-Trust and DC-RA algorithms, respectively.
• Privacy Protection Maximization: This subproblem focuses on protecting vehicle privacy during task offloading. It considers both the security of task execution nodes and the data transmission process. This objective is collaboratively addressed by:
  • LA-Trust: Updates the trust probability $P_{\mathrm{trust}}$ of edge nodes using Bayesian inference. This trust value directly affects offloading decisions.
  • DA-LDP: Applies a RR mechanism to select data points for perturbation (hereafter referred to as the RR step) and applies adaptive Gaussian noise to locally perturb sensitive vehicle data. The noise level is adjusted according to data heterogeneity, ensuring task execution accuracy while maintaining the total privacy budget ${ϵ}_{\mathrm{total}}$.

The overall privacy protection is modeled as an abstract function of these two components:

$$P_{\mathrm{privacy}}=g\left(f_{\mathrm{LA}\text{-}\mathrm{Trust}}\left(P_{\mathrm{trust}}\right), f_{\mathrm{DA}\text{-}\mathrm{LDP}}\left({ϵ}_{\mathrm{total}}\right)\right),$$

where $g(·)$ represents a conceptual measure capturing the joint effect of trust-based node selection and local differential privacy. Since the two mechanisms address privacy in different ways, $g(·)$ does not imply a direct arithmetic addition.

In the following sections, we describe the three proposed algorithms in detail.

4. Location-Aware and Trust-Based Task Offloading Algorithm

This section introduces the LA-Trust algorithm, which addresses the task offloading problem in vehicular edge computing, aiming to optimize offloading latency and enhance offloading security. The section mainly covers the offloading strategy, node modeling, design of the optimization function, and the overall algorithm framework.

4.1. Task Offloading Strategy

In the proposed algorithm, building upon vehicular tasks that have already been divided into multiple interdependent subtasks, these subtasks are treated as parallel task flows, forming a multi-flow offloading structure. The execution of each subtask respects the dependency constraints, while subtasks assigned to different edge nodes can receive and process data concurrently. By modeling tasks as multiple flows, the offloading strategy enables flow-level collaborative optimization across neighboring nodes, allowing the proposed approach to efficiently utilize available computational resources and reduce the overall task completion time. In this section, multiple subtasks are abstracted into a dual-subtask model. The offloading strategy covers different scenarios: local processing (Section 4.1.1), single-node offloading (Section 4.1.2), and dual-node offloading (Section 4.1.3 and Section 4.1.4). The extension to scenarios involving multiple subtasks and multiple edge nodes is discussed at the end of this section.

4.1.1. Processing Task Locally

When a task is processed locally, the service time is given by $Z_{loc}=\frac{d·c}{f_{loc}}$, where $f_{loc}$ is the local computing capability of the vehicle. The corresponding energy consumption for local task execution is given by $E_{loc}=P_{loc}·Z_{loc}$, where $P_{loc}$ denotes the power consumption of the vehicle during local processing.

4.1.2. Offloading Task to a Single Edge Node

Assuming that the channel gain at time t is $h_t$, the effective signal-to-noise ratio (SNR) between the vehicle and the edge node is expressed as $SNR\left(t\right)=\frac{P_{tx}·h_t·Di{s}^{-\gamma }}{N_0·B_e}$, where $P_{tx}$ represents the transmitted power of the vehicle, $Dis$ represents the distance between the vehicle and the edge node, $\gamma$ is the path loss exponent, $N_0$ is the noise power spectral density, and $B_e$ is the effective bandwidth. The data transmission time from the vehicle to the edge node is $Y_e=\frac{d}{B_e{\log }_2(1+SNR)}$. The processing time of the task at edge node e is $X_e=\frac{d·c}{C_t}$, where $C_t$ denotes the computing resources allocated to the task. Since the task result size is much smaller than the original data, the delay for returning results is neglected. Therefore, the total service time is $Z_e=X_e+Y_e$. The energy consumption for offloading the task to the edge node is $E_{off}=E_{tx}+E_e$, where the transmission energy is $E_{tx}=P_{tx}·Y_e$ and the processing energy is $E_e=P_e·X_e$.

4.1.3. Offloading Task to Two Neighboring Edge Nodes

We consider two correlated subtasks, A and B, where subtask B depends on the processing results of subtask A. The scheduling of these subtasks on two edge nodes can be classified into three cases.

• The transmission time of subtask A to edge node 1 is $Y_1$.
• The transmission time of subtask B to edge node 2 is $Y_2$.
• The processing time of subtask A at edge node 1 is $X_1$.
• The processing time of subtask B at edge node 2 is $X_2$.

Ignoring the transmission time of the results, the task service time and energy consumption are given by:

$$\begin{array}{cc}\hfill Z_e& =A_{\mathrm{comp}}\mathbf{x}+A_{\mathrm{trans}}\mathbf{y},\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill E_{off}& =E_{off}^A+E_{off}^B,\hfill \end{array}$$

(2)

where

$$\mathbf{x}=\left[\begin{array}{c}{X}_1\\ X_2\end{array}\right],\mathbf{y}=\left[\begin{array}{c}{Y}_1\\ Y_2\end{array}\right],$$

(3)

$A_{\mathrm{comp}}$ and $A_{\mathrm{trans}}$ are determined by the following situations.

Situation 1: Subtask A is completed at edge node 1, and edge node 2 has received the data for subtask B.

$$A_{\mathrm{comp}}=\left[\begin{array}{cc}1& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{cc}1& 0\end{array}\right].$$

Situation 2: Subtask A is not yet completed at edge node 1, but edge node 2 has received the data for subtask B.

$$A_{\mathrm{comp}}=\left[\begin{array}{cc}1& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{cc}1& 0\end{array}\right].$$

Situation 3: Subtask A is completed at edge node 1, but edge node 2 has not yet received the data for subtask B.

$$A_{\mathrm{comp}}=\left[\begin{array}{cc}0& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{cc}0& 1\end{array}\right].$$

4.1.4. Local and Single-Edge Collaborative Processing

Extending the dependency modeling between subtasks A and B in the previous subsection, this scenario considers collaborative processing between the vehicle and a single edge node. Depending on the relative ordering of transmission and computation, four cases are identified.

Situation 1: Subtask A is offloaded and processed at the edge node, while subtask B waits for the intermediate result at the vehicle.

$$A_{\mathrm{comp}}=\left[\begin{array}{cc}1& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{cc}1& 0\end{array}\right].$$

Situation 2: Subtask A is completed locally on the vehicle, and the edge node has already received the data of subtask B.

$$A_{\mathrm{comp}}=\left[\begin{array}{cc}1& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{cc}0& 0\end{array}\right].$$

Situation 3: Subtask A is completed locally on the vehicle, while the edge node has not yet finished receiving the data of subtask B.

$$A_{\mathrm{comp}}=\left[\begin{array}{cc}0& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{cc}0& 1\end{array}\right].$$

Situation 4: Subtask A has not yet been completed locally on the vehicle, whereas the edge node has already received the data of subtask B.

$$A_{\mathrm{comp}}=\left[\begin{array}{cc}1& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{cc}0& 0\end{array}\right].$$

Scalability Analysis of Task Decomposition and Scheduling. For scenarios involving multiple edge nodes due to overlapping coverage, a single task may consist of $n>2$ dependent subtasks. The scheduling can be extended by applying Equation (3) along with matrices $A_{\mathrm{comp}}$ and $A_{\mathrm{trans}}$, assigning each subtask to its corresponding node.

For example, consider a task consisting of three subtasks offloaded to three edge nodes. The task can be decomposed into two subtask groups: $(1\to 2)$ and $\left(\right\{1,2\}\to 3)$, which generate intermediate service times $Z_{12}$ and $Z_{23}$, respectively. These intermediate times are then aggregated to determine the overall execution time of the task. Specifically, the overall execution time can be computed as:

$$Z=\max \left(\max (Y_1+X_1+X_2,Y_2+X_2)+X_3,Y_3+X_3\right).$$

In the case corresponding to Situation 1, where the previous subtask finishes processing exactly when the next subtask finishes receiving, the matrices $A_{\mathrm{comp}}$ and $A_{\mathrm{trans}}$ can be extended as follows:

$$\mathbf{x}=\left[\begin{array}{c}{X}_1\\ X_2\\ X_3\end{array}\right],\mathbf{y}=\left[\begin{array}{c}{Y}_1\\ Y_2\\ Y_3\end{array}\right],$$

$$A_{\mathrm{comp}}=\left[\begin{array}{ccc}1& 1& 1\end{array}\right],A_{\mathrm{trans}}=\left[\begin{array}{ccc}1& 0& 0\end{array}\right].$$

Moreover, even if a task is divided into three subtasks under the current dual-node model, it can still be mapped to two nodes. For instance, subtasks 1 and 2 can be assigned to edge node 1, with their transmission and processing times accumulated as a single subtask A, while subtask 3 is assigned to edge node 2 as subtask B. This approach ensures that the two-subtask model remains applicable while preserving task dependencies and execution logic.

Therefore, the proposed two-subtask model serves as a representative unit for the general case. The framework can be naturally extended to scenarios with multiple overlapping edge nodes while maintaining the same scheduling logic.

4.2. Problem Formulation

Threat Model. Model edge nodes as honest-but-curious entities that strictly follow the prescribed protocol and can only access privacy-protected data uploaded by vehicles, without any access to raw sensitive information. Although data integrity and protocol execution are assumed to be correct, edge nodes may behave unreliably due to lightweight uncertainty attacks. Such attacks do not involve direct data tampering, but manifest as unpredictable service behaviors or passive inference attempts. In particular, an edge node may intentionally introduce random service delays during task processing, or attempt to infer sensitive information from the received perturbed data, such as reconstructing vehicle trajectories or spatial patterns. These behaviors do not violate the protocol execution assumption, but may degrade service reliability or threaten privacy.

Node Trust Initialization and Evolution. In the initial stage, due to the lack of sufficient historical observations, the prior trust of each edge node is typically obtained from expert judgment or offline evaluation, which may be subjective. To reduce uncertainty caused by single-source opinions, DST [40] is used to fuse multi-source evidence. The trust state of node e is modeled as a hypothesis set $H_e^{state}$, and each expert assigns basic belief masses. Let $Ex{p}_1$ and $Ex{p}_2$ denote two experts’ assessments; according to Dempster’s rule of combination, the fused trust probability is $P\left(H_e^{state}\right)=\frac{{\sum }_{Ex{p}_1\cap Ex{p}_2=H_e^{state}}Ex{p}_1\left(H\right)Ex{p}_2\left(H\right)}{1-k}$, where k is the conflict coefficient measuring the degree of disagreement between experts. This fusion process yields a more objective initial trust distribution, which serves as the prior for subsequent trust evolution and task offloading.

The trust state of node e is defined as three mutually exclusive and exhaustive hypotheses $H=\{H_e^0,H_e^1,H_e^2\}=\{\mathrm{untrusted},\mathrm{uncertain},\mathrm{trusted}\}$. Each expert $Ex{p}_i$ assigns belief masses $m_i\left(H_e^j\right)$ satisfying ${\sum }_j{m}_i\left(H_e^j\right)=1$. The fused distribution under DST is then $P\left(H_e^j\right)=\frac{{\sum }_{A\cap B=H_e^j}{m}_1\left(A\right)m_2\left(B\right)}{1-k}$.

During runtime, the trust is dynamically updated by Bayesian inference [41,42]. Given evidence E, Bayes’ theorem is $P(H\mid E)=\frac{P(E\mid H)P\left(H\right)}{P\left(E\right)}$.

At each decision epoch t, the observed evidence is $E^t=(r^t,a^t)$, where $r^t\in [0,1]$ is the task completion rate and $a^t$ is the number of detected uncertain attacks or abnormal events. Assuming independence between $r^t$ and $a^t$ under a given trust state $H_e^j$, the likelihood is $P(E^t\mid H_e^j)=P(r^t\mid H_e^j)·P(a^t\mid H_e^j)$.

The completion-rate likelihood is modeled as

$$P(r^t\mid H_e^j)=\left\{\begin{array}{cc}{p}_{r,j},\hfill & r^t\ge {\tau }_r,\hfill \\ 1-p_{r,j},\hfill & r^t<{\tau }_r,\hfill \end{array}\right.$$

(4)

where ${\tau }_r\in (0,1)$ is a threshold and $p_{r,j}$ indicates the tendency of achieving high completion rates. The attack count is modeled by a Poisson distribution:

$$P(a^t\mid H_e^j)=\frac{{\lambda }_j^{a^t}{e}^{-{\lambda }_j}}{a^t!},$$

(5)

where ${\lambda }_j$ denotes the expected number of abnormal events under state $H_e^j$. The posterior trust is updated via Bayesian inference, enabling continuous trust assessment and adaptive task offloading. Detailed derivation provided in Appendix C.

Strategy Formulation. To model vehicular task offloading decisions, a binary variable is first introduced. Let $a_b^i\in \{0,1\}$ denote the offloading decision of vehicle b for subtask i in time slot t. If $a_b^i=0$, subtask i is executed locally on the vehicle; if $a_b^i=1$, it is offloaded to the edge computing environment.

To further characterize fine-grained offloading behaviors, when $a_b^i=1$, a continuous variable

$$r_b^i\in (0,1]$$

(6)

is introduced to represent the offloading ratio of subtask i, i.e., the proportion of data or workload offloaded. Meanwhile, a discrete variable

$$e_b^i\in \mathcal{E}$$

(7)

denotes the selected target edge node, where $\mathcal{E}$ is the set of edge nodes accessible to the vehicle. Accordingly, the offloading decision of subtask i is formulated as a mixed decision consisting of continuous and discrete variables.

Under this formulation, $a_b^i$ determines whether offloading occurs, $r_b^i$ affects the transmission volume and thus the service latency and energy consumption, and $e_b^i$ specifies the execution node. If $a_b^i=0$, the service latency and energy consumption are given by $Z_{loc}^i$ and $E_{loc}^i$, respectively; otherwise, they are jointly determined by $Z_e^i$, $Z_{loc}^i$, $E_{off}^i$, and $E_{loc}^i$.

The overall service latency is expressed as

$$Z=\sum _{i=1}^n\left[a_b^i{Z}_e^i+(1-a_b^i)Z_{loc}^i\right],$$

(8)

where $Z_e^i$ and $Z_{loc}^i$ denote the latency of subtask i when executed at the edge and locally, respectively.

Similarly, the total energy consumption is given by

$$E=\sum _{i=1}^n\left[a_b^i{E}_{off}^i+(1-a_b^i)E_{loc}^i\right],$$

(9)

where $E_{off}^i$ and $E_{loc}^i$ represent the energy consumption of offloaded and local execution. Based on service time and energy consumption, the cost function is defined as:

$$f={\lambda }_1·Z+{\lambda }_2·E,$$

(10)

where ${\lambda }_1+{\lambda }_2=1$. The objective is to minimize the cost function f:

$$\begin{array}{cc}\hfill F& =\min \sum _{t=1}^{T}f,\hfill \\ \hfill \mathrm{s}.\mathrm{t}.& C_1:0\le l\le L,\hfill \\ \hfill & C_2:\sum _{i=1}^{n}i=K_b^t,\hfill \end{array}$$

(11)

where $C_1$ ensures that vehicles make offloading decisions within the coverage range of edge nodes, and $C_2$ ensures that each subtask in task $K_b^t$ is assigned a decision.

4.3. Algorithm Design

The structure of the LA-Trust algorithm is shown in Figure 2.

• System state: The system state observed by edge node e at time t is denoted as:

  $$s_e^t=\{e,t,Di{s}_e,K,T_{stay},P_{trust}\}.$$

  (12)
  Here, $Di{s}_e$ is the set of distances between vehicles and edge node e, K is the set of vehicle task information, $T_{stay}$ is the set of dwell times within the coverage of edge node e, and $P_{trust}$ is the set of trust probabilities of nodes. The overall system state at time t is represented as $S^t=\{s_1^t,\dots ,s_e^t,\dots ,s_E^t\}$.
• Action space: The action space is defined by the offloading ratio r and the edge node index e, where r denotes the proportion of subtask i. The action space contains both continuous and discrete variables.

  $$a_e^t=\left\{\left(a_b^i,{\left\{r_{b,e}^i\right\}}_{e\in E}\right)|\forall b\in B,i\in K_b^t\right\}.$$

  (13)
  The set of actions for all edge nodes at time t is denoted as $A^t=\{a_1^t,\dots ,a_e^t,\dots ,a_E^t\}$.
• Reward function: The objective is to minimize the cost function f and enhance security. The reward for edge node e at time t is defined as:

  $$r_e^t=-({\lambda }_1·Z+{\lambda }_2·E)+{\lambda }_3·P_{trust}.$$

  (14)
  The set of rewards for all edge nodes at time t is $R^t=\{r_1^t,\dots ,r_e^t,\dots ,r_E^t\}$.

Algorithm 1 outlines the LA-Trust algorithm process. Figure 3 presents the training process in a flowchart format for clearer illustration. First, the Actor and Critic network parameters ${\theta }_{\Pi }$ and ${\theta }_Q$ are initialized, and the corresponding target network parameters ${\theta }_{\Pi }^{\prime }$ and ${\theta }_Q^{\prime }$ are set equal to them. Similarly, the online DQN network parameters ${\theta }_{\mathrm{DQN}}$ are initialized, and the target DQN parameters ${\theta }_{\mathrm{DQN}}^{\prime }$ are set to the same initial values. The replay buffer B is initialized, and action noise $\xi$ is added to encourage exploration in the action space. Next, expert knowledge is combined via DST to assign an initial trust probability to each node, forming part of the system state. Upon receiving a task request, the edge node computes the vehicle’s residence time within its coverage and the distances to surrounding nodes, which are then incorporated into the system state. The edge node then generates task offloading strategies based on the current state $S^t$. The Actor network determines the continuous offloading ratios, and the DQN network selects the offloading nodes. After executing the joint action, the reward $R^t$ is calculated, and task completion rates together with node security logs are used to update the node trust probability. The system then transitions to the next state $S^{t+1}$, and the tuple $(S^t,A^t,R^t,S^{t+1})$ is stored in the replay buffer. Finally, a mini-batch is sampled from the buffer to train the networks. At each time step t, the Actor–Critic networks are updated first, followed by the DQN network. The algorithm complexity is provided in Appendix A.

Algorithm 1 LA-Trust Algorithm
1:	Initialize Actor network ${\theta }_{\Pi }$, Critic network ${\theta }_Q$, and DQN network ${\theta }_{\mathrm{DQN}}$
2:	Initialize target networks: ${\theta }_{\Pi }^{\prime }\leftarrow {\theta }_{\Pi },{\theta }_Q^{\prime }\leftarrow {\theta }_Q,{\theta }_{\mathrm{DQN}}^{\prime }\leftarrow {\theta }_{\mathrm{DQN}}$
3:	Initialize replay buffer B
4:	Set exploration noise $\xi$
5:	for each episode do
6:	for $t=1$ to T do
7:	Reset environment and obtain initial state $S^t$
8:	Initialize node trust probabilities $P_{\mathrm{trust}}$
9:	for each task $e=1$ to E do
10:	Compute vehicle metrics: staying time $T_{\mathrm{stay}}$ and distance $Di{s}_e$
11:	Actor: generate continuous offloading ratios $a_{\Pi }^t=\Pi \left(S^t\right)+\xi$
12:	DQN: select discrete offloading node $a_{\mathrm{DQN}}^t=\mathrm{DQN}\left(S^t\right)$
13:	Execute hybrid action $a_e^t$
14:	Obtain reward $r_e^t$, Update trust probability $P_{\mathrm{trust}}\leftarrow f\left(P_{\mathrm{trust}}\right)$, and observe next state $s_e^{t+1}$
15:	end for
16:	Store transition $(S^t,A^t,R^t,S^{t+1})$ in buffer B
17:	Sample mini-batch from B
18:	Critic update: compute ${\mathrm{Loss}}_{Critic}$ and update ${\theta }_Q$ using Equations (15) and (16)
19:	Actor update: compute ${\nabla }_{{\theta }_{\pi }}J\left({\theta }_{\pi }\right)$ and update ${\theta }_{\Pi }$ using Equation (17)
20:	DQN update: compute $Los{s}_{\mathrm{DQN}}$ and update ${\theta }_{\mathrm{DQN}}$ using Equations (20) and (21)
21:	Soft update all target networks: ${\theta }^{\prime }\leftarrow \tau \theta +(1-\tau ){\theta }^{\prime }$
22:	end for
23:	end for

The Critic network is updated using the following equations:

$$Q_{tar}=R^t+\gamma Q^{\prime }(S^{t+1},({\Pi }^{\prime }\left(S^{t+1}\right),DQ{N}_{target}\left(S^{t+1}\right))),$$

(15)

where $\gamma$ is the discount factor. The parameters of the Critic network, denoted as ${\theta }_Q$, are updated by minimizing the loss function:

$${\mathrm{Loss}}_{Critic}=\frac{1}{N}\sum _{i=1}^N{[Q_{tar}-Q(S^t,A^t)]}^2.$$

(16)

The Actor network is updated using the gradient computed from the Critic network:

$${\nabla }_{{\theta }_{\pi }}J\left({\theta }_{\pi }\right)=\frac{1}{N}\sum _{i=1}^N{\nabla }_{{\theta }_{\pi }}\left[Q(S^t,\Pi \left(S^t\right))\right].$$

(17)

A soft update strategy is applied to the target networks:

$${\theta }_{\Pi }^{\prime }\leftarrow \tau {\theta }_{\Pi }+(1-\tau ){\theta }_{\Pi }^{\prime },{\theta }_Q^{\prime }\leftarrow \tau {\theta }_Q+(1-\tau ){\theta }_Q^{\prime },$$

(18)

where $\tau$ is the soft update factor. The DQN network is updated as follows:

$$DQ{N}_{\mathrm{selected}}=\frac{1}{2}\left(DQ{N}_{online}(S^t,i)+DQ{N}_{online}(S^t,j)\right),$$

(19)

where $DQ{N}_{online}(S^t,i)$ and $DQ{N}_{online}(S^t,j)$ are the Q-values of selecting edge node i and j under state $S^t$, respectively. The target Q-value is obtained from the target DQN network:

$$\mathrm{TD}\mathrm{target}=R^t+\gamma \underset{e}{\max }DQ{N}_{target}\left(S^{t+1}\right).$$

(20)

The parameters of the online DQN network are updated by minimizing the loss function:

$$Los{s}_{\mathrm{DQN}}=\mathbb{E}\left[{\left(DQ{N}_{\mathrm{selected}}-\mathrm{TD}\mathrm{target}\right)}^2\right].$$

(21)

The target DQN network is also updated using the soft update strategy.

Convergence and Stability Analysis. Although providing a strict global convergence proof for hybrid-action multi-agent reinforcement learning remains an open theoretical challenge, we analyze the stability and convergence of the LA-Trust algorithm from both optimization-oriented and empirical perspectives.

From an optimization perspective, the Critic network, which connects continuous and discrete actions, treats the hybrid action as a unified input and is trained by minimizing the mean squared temporal-difference (TD) error. The Actor network is updated via deterministic policy gradients derived from the Critic, while the DQN network updates its parameters according to TD errors influenced by the continuous actions. Since the networks employ piecewise differentiable activation functions and are trained using gradient-based optimization with gradually decreasing learning rates, the loss functions can be reasonably approximated as continuous with respect to the network parameters under common DRL assumptions. Consequently, gradient-based optimization leads to smooth parameter updates during training. Moreover, experience replay reduces sample correlation, while the soft target update mechanism smooths the optimization process and suppresses oscillations. Combined with moderate learning rates, these mechanisms promote stable policy optimization and gradually reduce loss fluctuations during training.

From the perspective of gradient dynamics, gradient norms may be relatively large during the early exploration phase to facilitate rapid policy improvement and gradually decrease as the system stabilizes. Although system-level metrics, such as system reward, task completion rate, and resource efficiency, may exhibit stage-wise improvements due to exploration–exploitation transitions and multi-agent interactions, their overall trends remain stable and consistent with the desired system behavior.

From an empirical perspective, the training dynamics further validate stability. The system reward exhibits stable growth and gradually converges to a steady plateau without oscillatory divergence. Meanwhile, key system metrics, including task expiration rate, average delay, and average energy consumption, show overall decreasing trends and gradually stabilize during training. To verify convergence and stability, the networks are trained under five independent random initializations, as described in Section 7.1. The resulting performance exhibits low variance across runs and consistently converges, indicating that the training process is stable and relatively insensitive to random initialization. In addition, inference using the trained networks demonstrates that the framework can produce stable and effective offloading policies under different task size environments.

In summary, these optimization-oriented analyses and empirical observations indicate that the policy updates in the LA-Trust algorithm are controllable and predictable, achieving stable and effective convergence. The learned policies are effective and produce favorable practical outcomes.

5. Distribution-Aware Local Differential Privacy Algorithm

This section introduces the DA-LDP algorithm, which aims to provide adaptive privacy protection for multimodal vehicle data, enhance offloading security, and optimize downstream task accuracy within a given privacy budget. The section mainly covers the data perturbation strategy, the threat model, and the overall algorithm design.

5.1. Data Perturbation Strategy

Completing a vehicle perception task may require multiple types of data, such as vehicle trajectory, real-time location, and point cloud information. Based on the preceding discussion, the density and geometric mean of data serve as key indicators of data heterogeneity.

Vehicle trajectory data are time-series sequences that capture the positions, velocities, and accelerations of vehicles over time. These trajectories typically exhibit strong temporal continuity and regularity, meaning consecutive points are highly correlated and follow predictable motion patterns. As a result, the data possess high effective density and relatively stable geometric mean. Such high-density, structured data are sensitive to perturbations: adding excessive noise can distort temporal correlations, disrupt smooth trajectories, and degrade the performance of downstream tasks such as trajectory prediction, vehicle localization, and path planning.

In contrast, point cloud data consist of unordered sets of three-dimensional points that describe the spatial structure of the environment at a given time. Such data are often sparse and highly variable due to environmental changes, occlusion, and limited sensing resolution. As a result, the effective data density is relatively low, and the geometric mean shows larger variation. Downstream tasks based on point cloud data, such as three-dimensional object detection, semantic segmentation, and environment reconstruction, mainly rely on global or local spatial geometry rather than strict point-to-point continuity. Therefore, point cloud data can tolerate a higher level of noise without causing a significant loss in the performance of downstream tasks.

From this analysis, it is evident that the intrinsic data structure and temporal and spatial correlations strongly influence downstream task performance. Therefore, when adding noise to multimodal heterogeneous data, it is essential to consider these differences and adopt a targeted strategy that provides adaptive privacy protection while ensuring data availability. In particular, the geometric mean and data density can effectively capture these structural characteristics, serving as suitable indicators for determining appropriate noise levels.

The proposed DA-LDP algorithm analyzes the density and geometric mean of multimodal heterogeneous data, employs the Gaussian mechanism to generate adaptive noise, and applies RR step to determine which data are perturbed, thereby achieving effective privacy preservation.

5.2. Threat Model

Sensitive data are generated locally on vehicles and may be uploaded to edge nodes for collaborative perception. We adopt a LDP threat model, where data are perturbed on the client side before transmission.

Adversarial Observations. The adversary is assumed to observe only the perturbed data produced by the DA-LDP mechanism, such as noisy trajectories or Gaussian-perturbed point cloud features, and has no access to raw data, internal model parameters, or intermediate computations. Formally, let $x\in \mathcal{X}$ denote a sensitive data sample. The DA-LDP mechanism ${\mathcal{M}}_{\mathrm{DA}}$ outputs a perturbed value $y\in \mathcal{Y}$ as $y={\mathcal{M}}_{\mathrm{DA}}(x;ϵ,\delta )$, which the adversary can only observe.

Adversarial Goals. The adversary aims to infer sensitive information from the observed perturbed data, including but not limited to re-identification of vehicle trajectories, reconstruction of spatial structures from point clouds, or extraction of fine-grained location and motion patterns. Formally, for any two neighboring inputs $x,x^{\prime }\in \mathcal{X}$, the DA-LDP mechanism satisfies $(ϵ,\delta )$-local differential privacy:

$$\mathrm{Pr}[{\mathcal{M}}_{\mathrm{DA}}\left(x\right)\in \mathcal{S}]\le e^{ϵ}\mathrm{Pr}[{\mathcal{M}}_{\mathrm{DA}}\left(x^{\prime }\right)\in \mathcal{S}]+\delta ,\forall \mathcal{S}\subseteq \mathcal{Y}.$$

(22)

This indistinguishability bound ensures that, regardless of the inference strategy, the adversary cannot significantly increase its posterior confidence in distinguishing between neighboring sensitive inputs, thereby effectively limiting trajectory reconstruction and spatial inference attacks. Our focus is on bounding privacy leakage in an information-theoretic sense, rather than defending against a specific attack.

Security Assumptions. We assume that the mechanism ${\mathcal{M}}_{\mathrm{DA}}$ is correctly implemented and executed on the vehicle side and cannot be bypassed or tampered with by the adversary. External observers, including edge nodes and wireless eavesdroppers, are modeled as honest-but-curious adversaries: they follow the prescribed protocol but attempt to infer additional information from the received perturbed data.

Protection Scope and Boundaries. The proposed DA-LDP mechanism provides formal privacy guarantees under the $(ϵ,\delta )$-LDP framework, ensuring that the output distributions of neighboring inputs remain indistinguishable except with probability at most $\delta$ [43,44,45]. Although DA-LDP adaptively adjusts the noise scale according to data density and geometric mean, the privacy budget is strictly bounded, i.e., ${\sup }_{x\in \mathcal{X}}ϵ\left(x\right)\le ϵ$, which guarantees that the worst-case privacy protection is preserved. Therefore, the adaptive design of DA-LDP does not weaken the threat model, but redistributes noise within a fixed LDP budget to better preserve task-relevant features and downstream utility. Moreover, due to the post-processing property of local differential privacy [45], any function applied by the adversary to the perturbed output y cannot reduce the privacy guarantee. As a result, DA-LDP is robust against downstream inference, learning-based reconstruction, and model-driven attacks that rely solely on the perturbed data.

5.3. Problem Formulation

The Gaussian mechanism is a fundamental noise injection method in the DP framework, widely used in LDP settings to protect sensitive data by adding Gaussian noise $noise\sim \mathcal{N}(0,{\sigma }^2)$ before transmission. Here, $\sigma =\frac{\mathsf{\Delta }f·\sqrt{2\log (1.25/\delta )}}{ϵ}$, $\mathsf{\Delta }f$ represents the global sensitivity, $\delta$ is the failure probability that relaxes pure $ϵ$-DP, and $ϵ$ is the privacy budget. Applying this mechanism locally to a dataset D ensures Equation (22).

RR mechanism introduces uncertainty between true and reported values, and practical mechanisms often use biased probabilities to balance privacy and utility; for example, $p=\frac{e^{ϵ}}{1+e^{ϵ}}$ satisfies $ϵ$-DP [46]. In our DA-LDP mechanism, we use an RR step to randomly select data points for Gaussian noise perturbation according to the privacy budget ${ϵ}_{\mathrm{RR}}$. This step does not depend on the data structure, and the probability ratio of selecting any data point under different inputs is bounded by $e^{{ϵ}_{\mathrm{RR}}}$, ensuring that the RR step independently satisfies ${ϵ}_{\mathrm{RR}}$-LDP.

We select $M=k+1$ neighboring data points ${\left\{d_i^x\right\}}_{x=1}^M$ from the original dataset. For each data point $d_i^x$, we compute the average distance $\mathrm{AvgDist}\left(d_i^x\right)$ to its k nearest neighbors ${\left\{d_i^y\right\}}_{y=1}^k$ [47], excluding itself. This metric is defined as $\mathrm{AvgDist}\left(d_i^x\right)=\frac{1}{k}{\sum }_{y=1}^k\mathrm{dist}(d_i^x,d_i^y)$. The average distance of dataset $d_i$ is given by $\mathrm{AvgDist}\left(d_i\right)=\frac{1}{M}{\sum }_{x=1}^M\mathrm{AvgDist}\left(d_i^x\right)$. The density $\rho \left(d_i\right)$ of $d_i$ is defined as $\rho \left(d_i\right)=\frac{k}{\mathrm{AvgDist}\left(d_i\right)}$. Inspired by [48], the geometric mean g and the kernel $k_n$ are expressed as:

$$g=\exp \left(\frac{1}{M}\sum _{x=1}^M\log \rho \left(d_i^x\right)\right),$$

(23)

$$k_n=\frac{g}{\rho \left(d_i\right)}.$$

(24)

$k_n$ measures the variation in the data structure, providing a natural indicator for adaptive noise allocation. The Gaussian noise a is defined as:

$$a\sim \mathcal{N}(0,k_n^2{I}_w),$$

(25)

where $I_w$ denotes the w-dimensional identity matrix. For relatively stable data, such as vehicle trajectories, the geometric mean and density vary smoothly and remain relatively close, resulting in smaller noise to preserve data utility. In contrast, for data with greater structural fluctuations, such as point clouds, the difference between the geometric mean and global density is larger; in regions where features are dense, the geometric mean exceeds the global density, leading to larger noise allocation. To enforce a lower bound on the noise, we introduce a minimum protection limit ${ϵ}_{max}$ for the privacy budget $ϵ$, the variance corresponding to ${ϵ}_{max}$ is given by:

$${\sigma }_{min}=\frac{\mathsf{\Delta }f·\sqrt{2\log (1.25/\delta )}}{{ϵ}_{max}}.$$

(26)

Thus, Equation (25) can be rewritten as:

$$\begin{array}{cc}\hfill a& \sim \mathcal{N}(0,h^2{I}_w),\hfill \\ \hfill \mathrm{s}.\mathrm{t}.C_1:h& =\min (\max (k_n,{\sigma }_{min}),{\sigma }_{max}).\hfill \end{array}$$

(27)

${\sigma }_{\max }$ constrains the upper bound of the noise intensity. This bounded truncation maps $k_n$ to the feasible noise interval $[{\sigma }_{min},{\sigma }_{max}]$, preventing under- or over-perturbation while ensuring that the privacy budget remains within the predefined range.

To rigorously justify the privacy guarantees of the proposed DA-LDP mechanism, we first define the sensitivity for each mechanism.

For the RR step, which selects data points to perturb, the sensitivity is defined as

$$\mathsf{\Delta }{f}_{\mathrm{RR}}=\underset{D,D^{\prime }}{\max }{\parallel f_{\mathrm{RR}}\left(D\right)-f_{\mathrm{RR}}\left(D^{\prime }\right)\parallel }_2,$$

where D and $D^{\prime }$ are neighboring datasets differing in a single record, and $f_{\mathrm{RR}}$ denotes the mapping performed by the RR step. This sensitivity quantifies the maximum influence that a single record can have on the RR step output. By construction, the RR step ensures that for any two neighboring inputs d and $d^{\prime }$, and for any possible output o,

$$\frac{\mathrm{Pr}\left[\mathrm{RR}\mathrm{step}\right(d)=o]}{\mathrm{Pr}[\mathrm{RR}\mathrm{step}\left(d^{\prime }\right)=o]}\le e^{{ϵ}_{\mathrm{RR}}},$$

so that the mechanism independently satisfies ${ϵ}_{\mathrm{RR}}$-LDP. Intuitively, although the RR step selects which data points to perturb, the selection probabilities are fixed according to ${ϵ}_{\mathrm{RR}}$ and do not depend on the actual data values, which guarantees the LDP property.

Following the RR step, Gaussian noise is injected with variance determined by the data-dependent structure of the selected points. The sensitivity of the Gaussian mechanism is

$$\mathsf{\Delta }{f}_{\mathrm{Gauss}}=\underset{D,D^{\prime }}{\max }{\parallel f_{\mathrm{Gauss}}\left(D\right)-f_{\mathrm{Gauss}}\left(D^{\prime }\right)\parallel }_2,$$

and the Gaussian noise is calibrated according to

$$\sigma =\frac{\mathsf{\Delta }{f}_{\mathrm{Gauss}}\sqrt{2\log (1.25/\delta )}}{{ϵ}_{\max }},$$

where ${ϵ}_{\max }$ is a predefined upper bound on the privacy budget. This ensures that the Gaussian mechanism satisfies $({ϵ}_{\max },\delta )$-LDP, and the noise is constrained to a reasonable range to guarantee effective privacy protection.

By applying the standard sequential composition theorem of differential privacy [49], the overall mechanism obtained by sequentially applying the RR step and the Gaussian perturbation satisfies $({ϵ}_{\mathrm{total}},{\delta }_{\mathrm{total}})$-LDP, where

$${ϵ}_{\mathrm{total}}\le {ϵ}_{\mathrm{RR}}+{ϵ}_{\max },{\delta }_{\mathrm{total}}\le 0+\delta =\delta .$$

(28)

Therefore, the DA-LDP mechanism satisfies rigorous $({ϵ}_{\mathrm{RR}}+{ϵ}_{\max },\delta )$-local differential privacy guarantees.

5.4. Algorithm Design

Algorithm 2 illustrates the structure of the DA-LDP algorithm. First, the key parameters are initialized, including $\delta$, $ϵ$, and ${ϵ}_{max}$. The minimum variance of the Gaussian noise is then calculated based on ${ϵ}_{max}$. The parameter k is determined according to the size of the dataset D, and the value of $k_n$ is computed using Equation (24). Next, data points are selected using the RR step. Finally, Gaussian noise is generated according to Equation (27) and is added to the selected data to achieve privacy protection. The algorithm complexity is provided in Appendix B.

Algorithm 2 DA-LDP algorithm
1:	Input: Original dataset D, $\delta$, $ϵ$, ${ϵ}_{max}$, ${\sigma }_{max}$, $p=\frac{e^{ϵ}}{1+e^{ϵ}}$
2:	Output: Perturbed dataset $D^{\prime }$
3:	Compute the minimum variance ${\sigma }_{min}$ according to ${ϵ}_{max}$
4:	Obtain the dataset size U and set $k=\sqrt{U}$
5:	Calculate the kernel $k_n$ according to Equation (24), and generate Gaussian noise according to Equation (27)
6:	Use probability $q=1-p$ to select data points
7:	Add the generated Gaussian noise to the chosen data

6. Delay-Cost Reverse Auction Algorithm for Resource Incentive

This section introduces the DC-RA algorithm, which aims to address the data transmission latency introduced by resource auctions, with the goal of further reducing the overall task service time. The section mainly covers the resource auction strategy, the formulation of the optimization problem, and the overall algorithm design.

6.1. Resource Auction Strategy

Resource auctions are widely used in task offloading to reduce edge-node resource pressure and improve idle resource utilization. The total task service time consists of two parts. The first part is the service time between busy vehicles and edge nodes. The second part is the communication latency introduced by the auction process. In high-load task offloading scenarios, low service latency is particularly important. Therefore, the communication latency of the auction should be explicitly considered.

In the proposed scheme, edge nodes act as buyers and manage the auction process. Vehicles with idle resources act as sellers and submit bids in a voluntary manner. The buyer then selects vehicles based on their submitted bids.

6.2. Problem Formulation

We define a binary variable $v_s\in \{0,1\}$ to indicate whether idle vehicle s wins the bid. Specifically, $v_s=1$ denotes that vehicle s wins the bid, while $v_s=0$ denotes it does not. The edge node requires C units of computing resources to complete the task. To ensure successful task execution, the total resources $C_e$ obtained from winning vehicles must satisfy $C_e\ge C$. If vehicle s provides $u_s$ units of resources, the total resources collected by node e can be expressed as:

$$\begin{array}{cc}\hfill C_e& =\sum _{s=1}^m{v}_s·u_s,\hfill \\ \hfill \mathrm{s}.\mathrm{t}.& C_1:C_e\ge C,\hfill \end{array}$$

(29)

where m is the number of idle vehicles participating in the auction. The communication latency depends on the transmission distance, available bandwidth, channel conditions, and transmit power. It is given by:

$$T_{tx}=\frac{d}{B{\log }_2(1+\frac{\alpha ·h_t}{di{s}_s^{\gamma }})},$$

(30)

where d is the transmitted data size, B is the bandwidth, $\alpha =\frac{P}{N_0·B_e}$, $h_t$ is the channel gain, and $\gamma$ is the path loss exponent. Following [31], the cost for idle vehicles s is defined as the difference between the cost of providing $u_s$ resources and the reward $r_s$ received from the node:

$$Cos{t}_s=u_s·q_s-r_s.$$

(31)

The cost for node e is the total reward paid to the winning vehicles plus the communication latency:

$$Cos{t}_e=\sum _{s=1}^m{v}_s·(r_s+{\beta }_1·T_{tx}).$$

(32)

${\beta }_1$ is a positive delay coefficient used to balance the impact of data transmission delay on the overall cost. To encourage idle vehicles closer to node e to participate, the reward $r_s$ is defined as:

$$r_s=u_s·q_s·(1+\frac{{\beta }_c}{di{s}_s}),$$

(33)

where ${\beta }_c$ is a positive constant. A smaller $di{s}_s$ corresponds to a higher reward. The objective of the incentive mechanism is to minimize the total cost for both idle vehicles and edge nodes:

$$U=\min (\sum _{s=1}^{m}Cos{t}_s+\sum _{e=1}^{E}Cos{t}_e).$$

(34)

6.3. Algorithm Design

Algorithm 3 outlines the steps of the DC-RA algorithm. First, an empty list $S_{bid}$ is initialized to store the bids submitted by vehicles. Two additional empty lists are created: $V_{bid}$ to store the winning vehicles and F to store the results of cost calculations. The total resources currently collected, $C_e$, is initialized to zero. Next, for each idle vehicle bid in $S_{bid}$, the cost is calculated using Equations (31) and (32), and the results are stored in F. The values in F are then sorted in ascending order. Vehicles are selected sequentially from F as winners and added to $V_{bid}$. The selection continues until the total resources provided by the winning vehicles satisfy $C_e\ge C$.

We will prove that the proposed algorithm meets approximate truthfulness, individual rationality and computational efficiency.

Algorithm 3 DC-RA Algorithm
1:	Input: C
2:	Output: $V_{bid}$
3:	Initialize $S_{bid}$, $V_{bid}$, F, $C_e=0$
4:	for $J_s$ in $S_{bid}$ do
5:	Compute the cost using Equations (31) and (32), store the result in list F
6:	end
7:	Sort the list F in ascending order
8:	for each element in F do
9:	If $C_e<C$
10:	Add vehicle s to $V_{bid}$ and update $C_e=C_e+u_s$
11:	end

Theorem 1

(Approximate truthfulness). A mechanism is approximately truthful if, for every participating vehicle, reporting its true type (price, resources, distance) maximizes its expected utility or only allows a small expected gain from misreporting.

Lemma 1.

The proposed DC-RA algorithm guarantees approximate truthfulness.

Proof. 

(1) Monotonicity proof:

An allocation rule is monotone if for any vehicle s and any bid profile, whenever s is selected under some weight vector $\mathbf{w}$, and s reports a more favorable bid resulting in a weakly smaller weight, while other bids remain unchanged, then s must remain selected. Formally,

$$s\in M\left(\mathbf{w}\right)\Rightarrow s\in M\left({\mathbf{w}}^{\prime }\right),\mathrm{if}{w}_s^{\prime }\le w_s.$$

Substituting Equations (31) and (32) into the total objective, we obtain

$$\begin{array}{cc}\hfill U& =\sum _s{v}_s(u_s{q}_s-r_s)+\sum _s{v}_s(r_s+{\beta }_1{T}_{tx})\hfill \\ \hfill & =\sum _s{v}_s(u_s{q}_s+{\beta }_1{T}_{tx}).\hfill \end{array}$$

Define the weight of each vehicle as $w_s=u_s{q}_s+{\beta }_1{T}_{tx}\left(di{s}_s\right).$ Then the allocation rule can be equivalently written as

$$\underset{M}{\min }\sum _{i\in M}{w}_i\mathrm{s}.\mathrm{t}.\sum _{i\in M}{u}_i\ge C.$$

Let $\mathbf{w}=(w_1,\dots ,w_m)$ denote the original weight vector, and let

$$M^{*}=\arg \underset{M}{\min }\sum _{i\in M}{w}_i$$

be an optimal solution under $\mathbf{w}$. Assume vehicle s is selected, i.e., $s\in M^{*}.$ Now suppose vehicle s reports a more favorable bid, resulting in a reduced weight $w_s^{\prime }\le w_s$, while all other weights remain unchanged. Define the new weight vector ${\mathbf{w}}^{\prime }=(w_1,\dots ,w_s^{\prime },\dots ,w_m),$ and let

$$\tilde{M}=\arg \underset{M}{\min }\sum _{i\in M}{w}_i^{\prime }$$

be an optimal solution under ${\mathbf{w}}^{\prime }$.

We prove monotonicity by contradiction. Assume that $s\notin \tilde{M}.$ Since $\tilde{M}$ is optimal under ${\mathbf{w}}^{\prime }$, we have

$$\sum _{i\in \tilde{M}}{w}_i^{\prime }\le \sum _{i\in M^{*}}{w}_i^{\prime }.$$

If a set M does not contain s, then its total weight does not change, i.e., ${\sum }_{i\in M}{w}_i^{\prime }={\sum }_{i\in M}{w}_i.$ If a set M contains s, then ${\sum }_{i\in M}{w}_i^{\prime }={\sum }_{i\in M}{w}_i-(w_s-w_s^{\prime }).$

Since $\tilde{M}$ does not contain s, its total weight remains unchanged:

$$\sum _{i\in \tilde{M}}{w}_i^{\prime }=\sum _{i\in \tilde{M}}{w}_i.$$

Similarly, because $M^{*}$ contains s, its total weight decreases by $(w_s-w_s^{\prime })$:

$$\sum _{i\in M^{*}}{w}_i^{\prime }=\sum _{i\in M^{*}}{w}_i-(w_s-w_s^{\prime }).$$

Substituting these into the optimality inequality yields

$$\sum _{i\in \tilde{M}}{w}_i\le \sum _{i\in M^{*}}{w}_i-(w_s-w_s^{\prime }).$$

In the case that vehicle s reports a more favorable bid, i.e., $w_s^{\prime }<w_s$, we have $(w_s-w_s^{\prime })>0$, and thus

$$\sum _{i\in \tilde{M}}{w}_i<\sum _{i\in M^{*}}{w}_i.$$

However, this inequality implies that under the original weight vector $\mathbf{w}$, the set $\tilde{M}$ has strictly smaller total weight than $M^{*}$, which contradicts the optimality of $M^{*}$. This contradiction arises from our assumption that $s\notin \tilde{M}.$

Therefore, the assumption is false, and we conclude that

$$s\in M^{*}\Rightarrow s\in \tilde{M}.$$

This is exactly the monotonicity condition defined at the beginning. Hence, the allocation rule is monotone.

(2) Approximate critical-value payment proof:

Since the allocation rule satisfies monotonicity, by Myerson’s characterization theorem, there exists a corresponding critical-value payment rule that makes the mechanism truthful. Denote this ideal critical payment by $r_s^{*}$. In practice, the actual reward $r_s$ is not strictly a critical-value payment, but serves as a practical incentive scheme that constrains vehicles’ strategic deviation and provides strong incentives, thus ensuring approximate truthfulness.

We introduce the definition of $\epsilon$-incentive compatibility: for any vehicle s and any misreported type ${\widehat{\theta }}_s$, the difference in expected utility between reporting the true type ${\theta }_s$ and the misreported type satisfies

$$U_s({\theta }_s,{\theta }_{-s})\ge U_s({\widehat{\theta }}_s,{\theta }_{-s})-\epsilon ,$$

(35)

where the vehicle utility is defined as

$$U_s=r_s-u_s{q}_s,$$

(36)

In the vehicular network system, the communication distance $di{s}_s$ of vehicles is constrained by the edge node coverage, with finite minimum and maximum values:

$$0<d_{\min }\le di{s}_s\le d_{\max }.$$

Here, $d_{\min }$ is strictly positive and does not approach zero. In practical systems, edge nodes are installed at fixed positions and strictly positive heights, and are never embedded inside vehicles or placed arbitrarily close. Furthermore, there exists a minimum physical distance either between vehicles or between a vehicle and an edge node, due to vehicle dimensions and safe driving distances (e.g., a typical vehicle length or axle distance of 2–5 m). From the communication model perspective, $di{s}_s$ also cannot approach zero because practical wireless hardware and channel models impose constraints; if the distance were extremely small, the received signal power would enter non-physical near-field regimes or exceed hardware limits. Large-scale urban and outdoor path loss models explicitly account for a minimum operational distance, and multiple studies indicate that received signal power cannot grow without bound. Therefore, $di{s}_s$ has an inherent positive lower bound, ensuring that expressions involving $1/di{s}_s$ remain finite in the analysis of reward and utility. Moreover, the computation resources and bids provided by vehicles are constrained by physical and platform rules:

$$0<u_{\min }\le u_s\le u_{\max },0<q_{\min }\le q_s\le q_{\max }.$$

If vehicle s misreports its distance as ${\widehat{dis}}_s$, the reward changes from Equation (33) to

$$r_s\left({\widehat{dis}}_s\right)=u_s{q}_s\left(1+\frac{{\beta }_c}{{\widehat{dis}}_s}\right),$$

resulting in a utility deviation

$$\mathsf{\Delta }{U}_{dis}=U_s\left({\widehat{dis}}_s\right)-U_s\left(di{s}_s\right)=r_s\left({\widehat{dis}}_s\right)-r_s\left(di{s}_s\right)=u_s{q}_s{\beta }_c\left(\frac{1}{{\widehat{dis}}_s}-\frac{1}{di{s}_s}\right).$$

Using the bounds on distance, this deviation can be upper-bounded as

$$|\mathsf{\Delta }{U}_{dis}|\le u_{\max }{q}_{\max }{\beta }_c\left|\frac{1}{d_{\min }}-\frac{1}{d_{\max }}\right|\triangleq {\epsilon }_{dis}.$$

If the vehicle misreports the resources ${\widehat{u}}_s=u_s+\mathsf{\Delta }u$ and the unit price ${\widehat{q}}_s=q_s+\mathsf{\Delta }q$, the reward changes accordingly, and the utility deviation is

$$|\mathsf{\Delta }{U}_{res}|=U_s({\widehat{u}}_s,{\widehat{q}}_s)-U_s(u_s,q_s)=\frac{{\beta }_c}{di{s}_s}\left(u_s\mathsf{\Delta }q+q_s\mathsf{\Delta }u+\mathsf{\Delta }u\mathsf{\Delta }q\right).$$

Using the bounds $u_s\le u_{\max }$, $q_s\le q_{\max }$, $\left|\mathsf{\Delta }u\right|\le \mathsf{\Delta }{u}_{\max }$, $\left|\mathsf{\Delta }q\right|\le \mathsf{\Delta }{q}_{\max }$, and $di{s}_s\ge d_{\min }$, we obtain

$$|\mathsf{\Delta }{U}_{res}|\le \frac{{\beta }_c}{d_{\min }}\left(u_{\max }\mathsf{\Delta }{q}_{\max }+q_{\max }\mathsf{\Delta }{u}_{\max }+\mathsf{\Delta }{u}_{\max }\mathsf{\Delta }{q}_{\max }\right)\triangleq {\epsilon }_{res}.$$

Combining the distance and resource misreporting deviations, the total utility deviation is bounded by

$$U_s({\widehat{\theta }}_s,{\theta }_{-s})-U_s({\theta }_s,{\theta }_{-s})=|\mathsf{\Delta }{U}_{dis}|+|\mathsf{\Delta }{U}_{res}|\le {\epsilon }_{dis}+{\epsilon }_{res}\triangleq \epsilon ,$$

which implies

$$U_s({\theta }_s,{\theta }_{-s})\ge U_s({\widehat{\theta }}_s,{\theta }_{-s})-\epsilon .$$

This provides a formal quantitative bound on the utility gain from misreporting, showing that the mechanism satisfies $\epsilon$-incentive compatibility, and thus guarantees approximate truthfulness for physically realistic parameter ranges.

In summary, based on the above reasoning and supported by prior work on approximate incentive compatibility [50,51], we conclude that the proposed mechanism satisfies approximate truthfulness. □

Theorem 2

(Individual rationality). Each vehicle achieves a non-negative utility when participating in the auction.

Lemma 2.

The proposed DC-RA algorithm ensures individual rationality.

Proof. 

According to the reward design Equation (33), the utility of vehicle s is

$$U_s=r_s-u_s·q_s=u_s·q_s·\frac{{\beta }_c}{di{s}_s}.$$

Since $u_s>0$, $q_s>0$, ${\beta }_c>0$, and $di{s}_s>0$, it follows that $U_s\ge 0$. Hence, each vehicle achieves non-negative utility, and the mechanism satisfies individual rationality. □

Theorem 3

(Computational efficiency). The algorithm completes computations within a reasonable amount of time and resource consumption, and is able to adapt to large-scale participant environments.

Lemma 3.

The proposed DC-RA algorithm satisfies computational efficiency and scalability.

Proof. 

Each idle vehicle submits a bid $J_s$ with time complexity $O\left(1\right)$. For m vehicles, bid submission requires $O\left(m\right)$. The edge node computes costs for all bids using simple operations, also $O\left(m\right)$. Sorting the cost list has complexity $O\left(m\log m\right)$. Selecting winning vehicles sequentially from the sorted list until the resource requirement is met requires at most $O\left(m\right)$. Reward distribution to winning vehicles requires at most $O\left(m\right)$. Therefore, the overall time complexity is $O\left(m\log m\right)$. The storage for m vehicles is $O\left(m\right)$, giving space complexity $O\left(m\right)$. Thus the proposed algorithm satisfies the computational efficiency. □

7. Experiment Results and Discussion

In this section, we evaluate the effectiveness of the proposed framework through experiments. All experiments were conducted on a workstation equipped with an Intel(R) Xeon(R) Gold 6133 CPU @ 2.50 GHz, 128 GB of RAM, and an NVIDIA RTX A6000 GPU. The GPU driver version is 535.183.01 with CUDA 12.2 support. The algorithms were implemented in Python 3.8 using PyTorch 2.1.0.

First, we simulate a vehicle task offloading environment with randomly generated task information and vehicle locations [52,53,54]. We compare the proposed LA-Trust algorithm with three other multi-agent methods in terms of task completion rate, delay, and related metrics. Second, we construct a dataset based on NuScenes dataset (v1.0-mini) [55] to evaluate DA-LDP by comparing its task execution accuracy with that of other privacy-preserving algorithms. Third, we create an idle resource auction environment following [56] to demonstrate the superiority of the DC-RA algorithm in auction cost and communication latency. Furthermore, we conduct an end-to-end evaluation by jointly integrating LA-Trust and DC-RA to verify the overall system latency performance. Finally, under the privacy assumptions of DA-LDP and LA-Trust, we evaluate the resistance of the proposed method to reconstruction attacks, verifying its privacy protection capability.

7.1. Evaluation of LA-Trust Algorithm

Settings and experiments: The Actor, Critic, and DQN networks are feedforward networks with two hidden layers each, and ReLU activations are applied to all hidden layers. Key training and additional parameters are summarized in

Table 2. Parameters for LA-Trust experiments.

Parameter	Value
Actor hidden layers	2 layers with 64 and 32 units
DQN hidden layers	2 layers with 64 and 32 units
Critic hidden layers	2 layers with 512 and 128 units
Optimizer	Adam
Activation function	ReLU
Max episode	500
Random seed	37
Number of agents	16
Bandwidth	40 MHz
Channel	10
${\lambda }_1$	0.59
${\lambda }_2$	0.39
${\lambda }_3$	0.02
$p_{r,j}$	$H_e^0$: 0.30, $H_e^1$: 0.60, $H_e^2$: 0.90
${\lambda }_j$	$H_e^0$: 3.0, $H_e^1$: 1.0, $H_e^2$: 0.2
${\tau }_r$	0.5
$a^t$	$\{0,1,2,3\}$
Discount factor $\gamma$	0.99
Target network update rate $\tau$	1
Replay buffer capacity	10,000
Batch size	64
Number of experts	3
Expert knowledge	[0.5–0.9]
Task size	[30–70] MB
Task deadline	[0.1–1] s
Vehicle location	[1–100] m
Distance between vehicle and edge node	[1–100] m
The height of edge node	3 m
Actor network learning rate	0.0001
Critic network learning rate	0.001
CPU cycles for processing one bit of data	[300–737.5] cycles

. Following the commonly adopted simulation design in the related works, task parameters and vehicle spatial positions are randomly sampled within predefined ranges listed in Table 2. This random generation mechanism ensures diversity of task demands and spatial distributions while avoiding bias toward specific workload patterns. Security logs, including the number of uncertainty attacks ($a^t$) and task completion rates, are used to update the nodes’ trust probabilities. $a^t$ for each edge node is generated randomly as an integer selected from $\{0,1,2,3\}$. The proposed algorithm is compared with the following three algorithms:

• MADDPG: The baseline algorithm on which the proposed method is built.
• Deadline-MADDPG: Based on MADDPG, vehicle tasks are sorted in ascending order according to their deadlines and offloaded to edge nodes sequentially.
• CCM [54]: A hybrid MADDPG algorithm introducing hybrid strategies.

Each algorithm is run five times, with 500 episodes per run. The environment uses a fixed random seed of 37, and the network weights are reinitialized for each run. Each algorithm produces five independent results, and the final performance is plotted as the mean values with 95% confidence intervals.

Results and analysis: Figure 4a shows the rewards obtained by the four algorithms during the experiment. For a fair comparison, the reward of our algorithm without considering node trust probability is also shown, represented by the blue dashed line. Since the reward combines negative time and energy costs, higher values indicate better performance. The results show that the proposed algorithm outperforms the comparison algorithms. Compared to the baseline, the cost is reduced by 64.41%. This improvement mainly stems from the coordinated task allocation strategy across available nodes, which alleviates congestion at individual nodes and reduces the waiting time for both task transmission and execution, thereby increasing the accumulated reward. Furthermore, node security is incorporated as an important factor in the offloading decision. By introducing node trust probability into the decision-making process, the algorithm prioritizes more reliable nodes for task execution, which enhances the security of the offloading process and further contributes to the improvement of the accumulated reward. Figure 4b shows the percentage of unfinished tasks, where lower values indicate better performance. Among the four algorithms, our algorithm achieves the lowest task expiration rate, which is 0.2% lower than the baseline. Since our algorithm allows partial temporal overlap between task transmission and execution, the accumulation of waiting time is effectively reduced. As a result, more tasks can be completed before their deadlines, thereby lowering the task expiration rate. Figure 4c shows the average delay of task transmission and execution. Clearly, our algorithm significantly reduces delay, which is 64.64% lower than the baseline. This improvement is mainly attributed to the parallel processing mechanism incorporated in the proposed algorithm. By enabling task transmission and execution to partially overlap in time, the algorithm alleviates the service time bottleneck encountered under high-load task scenarios. Consequently, the accumulation of waiting time is effectively reduced, resulting in a lower offloading delay. Figure 4d shows that the energy consumption of our algorithm remains within reasonable limits. The total energy consumption consists of both task transmission energy and processing energy. The results indicate that the proposed parallel processing mechanism does not introduce excessive energy overhead, demonstrating that the reduction in delay is achieved without significantly increasing the overall energy cost. Figure 5 compares the delay and task completion rate across different task sizes. Our algorithm achieves optimal performance in both response speed and completion rate. From the above results, it can be seen that under high-load task scenarios, the parallel processing mechanism in our algorithm plays a crucial role. As the task size increases, the performance advantage of our algorithm becomes increasingly significant. This is because larger tasks typically result in longer transmission and execution durations, which increase overall resource occupation time under high-load scenarios. As a consequence, system delay becomes more sensitive to task size growth. By contrast, the parallel processing mechanism in our algorithm enables partial temporal overlap of task transmission and execution time, thereby alleviating delay accumulation under high-load tasks and slowing the growth rate of latency with respect to task size.

To verify that our algorithm improves the security of task offloading, we tracked the offloaded tasks and analyzed node selection. As shown in Figure 6, nodes with trust probabilities of [0–0.7] are defined as low-trust, [0.7–0.8] as mid-trust, and [0.8–1.0] as high-trust. Our algorithm offloads the highest percentage of tasks to nodes with high-trust probability while avoiding nodes with low-trust probability. This indicates that integrating node trust probability into the overall optimization objective effectively guides task offloading decisions. The algorithm takes into account not only conventional factors such as task deadlines and resource availability but also the security level of candidate nodes. By prioritizing high-trust nodes and avoiding low-trust nodes, it ensures more secure task execution.

7.2. Evaluation of DA-LDP Algorithm

Settings and experiments: We construct a dataset based on the NuScenes dataset (v1.0-mini), containing privacy-sensitive data, including vehicle trajectories and LiDAR point clouds. The dataset contains 404 annotated samples corresponding to 31,206 sensor frames. Each sample includes the timestamp of the LiDAR frame, the 3D position $(x,y,z)$ of the ego vehicle extracted from ego poses, the point cloud represented as a set of 4-channel points $(x,y,z,i)$, and a downstream task ground truth label indicating the number of annotated 3D bounding boxes in the frame. This label measures the road traffic environment complexity by counting vehicles, pedestrians, and other objects, and the downstream task is defined as predicting the number of 3D bounding boxes in each frame. The downstream task network is modeled with a feedforward network with two hidden layers. Key architectural and additional parameters are summarized in

Table 3. Parameters for DA-LDP experiments.

	Parameter	Value
Downstream Task Network Settings	Hidden layers	2 layers with 128 units per hidden layer
	Optimizer	Adam
	Activation function	ReLU
	Dropout rate (hidden layer 1)	0
	Dropout rate (hidden layer 2)	0.1
	Learning rate	0.0015
	Batch size	64
	Training epochs	500
LDP Parameters	Random seed	12
	$\delta$	$1\times {10}^{-5}$
	${ϵ}_{\max }$	5
	${\sigma }_{max}$	20
	$ϵ$	[0.1–2]
	Sensitivity $\mathsf{\Delta }f$	10
	k	$\sqrt{404}\approx 20$

. k is set to the square root of the dataset size [57,58,59]. $k_n$ was computed separately for vehicle trajectories and point clouds, yielding ranges of $[0.593,12.797]$ and $[0.142,21.286]$, respectively. Based on these ranges, the noise upper bound ${\sigma }_{\max }$ was further determined. The dataset is divided into a training set (80%) and a test set (20%). Task execution accuracy is defined as the proportion of frames in which the number of bounding boxes output by the network matches the ground truth. This metric, which measures integer count matching accuracy, is used to evaluate how privacy-preserving perturbations affect the performance of the pre-trained network on the downstream task. After training, the network is tested on the test set, and the resulting accuracy is used as the baseline for comparison with subsequent methods. Our algorithm and two comparison algorithms are applied to perturb the test dataset. Specifically, for LiDAR point clouds, noise is independently added to each point’s $(x,y,z)$ coordinates according to the perturbation mechanism; for vehicle trajectories, noise is independently added to each trajectory point’s $(x,y)$ coordinates. We compare our algorithm with two baselines: (i) a Laplace-based LDP algorithm that adds fixed noise to the data, and (ii) the algorithm proposed in [26], hereinafter referred to as Xia’s algorithm. To ensure a fair comparison, all algorithms adopt the same privacy budget settings $\{5.1,5.5,6,7\}$.

Results and analysis: Figure 7 shows the network training results. The network loss decreases steadily, and the accuracy increases consistently, indicating that the combination of the dataset and the network is effective, and that the network is able to adapt to the dataset and produce meaningful downstream task predictions. This establishes a solid foundation for the subsequent evaluation of task execution accuracy. Figure 8 shows the task execution accuracy for the three algorithms at varying levels of perturbation of the test dataset. The baseline accuracy is 0.7. Among the three algorithms, the test dataset perturbed by our algorithm is closest to the benchmark. Adding fixed Laplace noise to the multimodal heterogeneous data results in the lowest task execution accuracy. Xia’s algorithm combines Laplace noise with effective data selection, which improves task execution accuracy. Compared with traditional LDP algorithms employing fixed noise injection, our algorithm improves task execution accuracy by approximately 38%. This demonstrates that the dynamic noise protection mechanism in our algorithm effectively preserves task execution accuracy for heterogeneous data. Unlike uniformly injecting fixed noise, our method adaptively allocates noise within the privacy budget according to the density and geometric mean characteristics of different data types. By applying differentiated perturbation levels to heterogeneous data, the algorithm improves task execution accuracy while satisfying privacy constraints.

Figure 9 visualizes the effect of our algorithm on vehicular trajectory and LiDAR point cloud for a privacy budget of $ϵ=6$. Due to memory limitations of the experimental setup, only a subset of the data is shown. For clarity, the relatively important coordinates are visualized: the XY-plane of the vehicle trajectory and the XYZ coordinates of the LiDAR point cloud. Figure 9a displays two segments of the vehicle trajectory, specifically from the lower-left and upper-right regions. The connecting line between these segments does not represent actual vehicle movement but indicates their relative positions in the dataset. It can be observed that the perturbed points are visibly displaced from the original positions while still following the overall trend of the original trajectory. In the lower-left segment, the original trajectory exhibits a sharp turn, causing fluctuations and an increase in the geometric mean. As a result, $k_n$ increases according to our algorithm, and the noise is slightly more pronounced compared with the smoother trajectory in the upper-right segment. By analogy, point clouds with greater variability would experience stronger noise. Figure 9b shows a single frame of LiDAR point cloud. The perturbed points follow the spatial distribution of the original points. Compared with the vehicle trajectory, the noise in the point cloud is more pronounced, indicating that under the same privacy budget, the perturbation applied to point clouds is stronger than that applied to vehicle trajectories.

7.3. Evaluation of DC-RA Algorithm

Settings and experiments: The remaining parameters are set as follows: the distance of idle vehicles from the node $dis$ is within [50–500] m; the unit price of resources $q_i$ is within [1–1.8] $/MHz; the amount of resources $u_i$ offered is within [2–8] MHz; the bandwidth is 40 MHz; and the coefficients ${\beta }_1=5$, ${\beta }_c=1$, $\alpha ·h_t=5\times {10}^{10}$, and $\gamma =3$.

Assume that the vehicle location generation process is related to the parameter ${\beta }_c$, which is consistent with the role of ${\beta }_c$ in the reward function for regulating vehicle participation incentives. Specifically, as ${\beta }_c$ increases, the number of vehicles participating in the auction and located closer to the edge node correspondingly increases, reflecting a stronger incentive effect. The bidding behavior of idle vehicles follows a distance-aware random generation strategy, in which both the unit price and the amount of resources offered by each vehicle are related to its distance from the edge node. In general, vehicles closer to the edge node tend to report higher unit prices and provide more computational resources. Meanwhile, random perturbations are introduced to capture the heterogeneity of vehicles in terms of computational capability and bidding willingness. A distance-based communication latency rule is applied: vehicles within 400 m of the edge node receive data in parallel, while those beyond 400 m experience increased latency and receive data individually. We compare our algorithm with two algorithms: (i) the RB scheme, which randomly selects vehicles among participants as winners until the target resource amount is met, and (ii) the CRSA scheme [31], which selects vehicles in ascending order of unit price until the target resource amount is met.

Each algorithm is run five times, with bids from idle vehicles changing in each run, producing five independent results. The random seeds used in the experiments are fixed to 29, 32, 42, 44, and 48. The final performance is plotted as the average of these results.

Results and analysis: Figure 10a shows the relationship between the total cost and the resources purchased by an edge node when 15 idle vehicles participate in the auction. In practice, higher purchased resources indicate larger task data size. Thus, the transmitted data size is assumed to be proportional to the purchased resources. The results show that the total cost increases as the required resources increase. Notably, our algorithm reduces the total cost by 19% compared to the RB algorithm for the same purchased resources. Figure 10b shows the communication latency between the node and the winning vehicles under the same conditions, which increases with the amount of transmitted data. Compared to the CRSA algorithm, our algorithm reduces communication latency by 13%. Figure 10c shows the relationship between the total cost and the number of participating idle vehicles when the edge node needs to purchase 30 MHz of resources. The total cost decreases as the number of idle vehicles increases, due to increased options and intensified competition among vehicles. Compared to the RB algorithm, our algorithm reduces the total cost by 4.5%. Figure 10d shows the impact of the number of participating idle vehicles on communication latency when the transmitted data is 30 MB. As the number of vehicles increases, our algorithm achieves a steady decline in communication latency, due to the higher probability of selecting vehicles closer to the edge node. Our algorithm reduces communication latency to less than 0.7 s when 35 vehicles participate in the auction, representing a 44% reduction compared to the CRSA algorithm. Overall, our algorithm demonstrates a clear advantage in terms of communication latency. By explicitly incorporating latency into the objective function and considering it during the resource auction process, the algorithm effectively balances total resource cost and communication distance, resulting in a significant reduction in average communication latency. While the optimization of total cost is less pronounced, this reflects a deliberate trade-off: the algorithm keeps costs within a reasonable range while achieving substantial latency improvement.

To validate the advantage of the proposed algorithm in selecting nearby vehicles, the distances between winning vehicles and the edge node were recorded over five experiments and plotted in Figure 11. The results show that the proposed algorithm achieves an average winning distance of approximately 210 m, while CRSA and the random selection strategy yield about 340 m and 260 m, respectively. This outcome is consistent with expectations: under the joint optimization of cost and delay, the proposed algorithm tends to select closer vehicles as winners, thereby reducing data transmission delay. In contrast, CRSA selects vehicles solely based on unit price. In our experimental setup, vehicles with lower unit prices are generally farther from the node, leading CRSA to more frequently choose distant vehicles. The random strategy lacks selection criteria, resulting in larger error bars and indicating greater variability and instability in the selected distances.

Figure 12 shows the variation of system total cost and average communication latency under different ${\beta }_1$ and ${\beta }_c$ values. In Figure 12a, the total cost first decreases and then increases as ${\beta }_1$ and ${\beta }_c$ grow. When ${\beta }_c=0.5$, low vehicle rewards reduce the participation of nearby vehicles, forcing the edge node to select distant winners and thus increasing transmission delay. Under ${\beta }_1=5$, the delay term dominates the cost, causing a rise. As ${\beta }_c$ increases to 1, more vehicles (including medium-distance and some nearby ones) join the auction, enabling a better balance between resource price and delay and reducing the total cost. When ${\beta }_c$ increases further, the total cost rises again because the node prefers closer vehicles, but their higher unit resource prices outweigh the delay reduction. The effect of ${\beta }_1$ on total cost is similar. When ${\beta }_1=0.5$, the system mainly optimizes price and ignores delay, resulting in distant vehicle selection and a large delay increase. As ${\beta }_1$ increases to 1, the total cost decreases, indicating a balanced trade-off. Further increasing ${\beta }_1$ strengthens the emphasis on delay, leading to closer vehicle selection, but higher prices cause a slight cost increase. In Figure 12b, the average communication latency steadily decreases with increasing ${\beta }_1$ and ${\beta }_c$, since the system places more weight on delay and prefers closer winners.

Figure 13 illustrates the effect of a $\pm 10\%$ distance error on the proposed algorithm under the same experimental conditions as those in Figure 10. To simulate potential GPS measurement errors, the distances of idle vehicles participating in the auction are randomly perturbed by ±$10\%$ relative to their true values. As shown in the figure, in the presence of ±$10\%$ distance perturbations, the overall trends remain consistent with the error-free scenario, exhibiting only minor fluctuations. This indicates that the proposed algorithm remains effective in reducing latency even under distance measurement uncertainty.

Under the same experimental settings as in Figure 10, we compare the total cost and average communication latency under truthful reporting and stochastic price misreporting, where each vehicle misreports with a probability of 10–20% and underbids its original price by 5–10%. The results are shown in Figure 14. From the results, it can be observed that under price misreporting, both the total cost and the average communication latency increase slightly, while the overall trends remain consistent with truthful reporting. Specifically, as shown in Figure 14a, the total cost increases by up to approximately 6%, and in Figure 14b, the average communication latency increases by up to approximately 5%. These results indicate that even in the presence of strategic price misreporting by vehicles, the proposed mechanism maintains good performance in terms of total cost and average communication latency.

In summary, the findings in Figure 13 and Figure 14 indicate that the proposed algorithm maintains stable performance under uncertainties, including measurement errors and strategic misreporting. This robustness arises from the joint optimization of cost and latency: even when vehicle bids deviate from their true values, the algorithm mitigates the potential impact on total cost and communication latency by selecting more suitable vehicles from multiple candidates during the auction process.

7.4. End-to-End Latency Evaluation of the Framework

This section conducts an end-to-end latency evaluation by integrating the task offloading module with the resource auction module. By comparing the latency performance of different combinations, the cooperative effect and superiority of the proposed task offloading and auction modules are validated.

Settings and experiments: We assume that the offloading decisions are not affected by the auction model. The experimental parameters for each module follow the settings in Section 7.1 and Section 7.3. In the joint evaluation, the system operates as follows: the task offloading module first generates an offloading strategy for each vehicle task. When the decision is to offload to an edge node, after the edge node completes receiving the offloaded task data, further transmits a portion of the task data to the winning vehicle. The amount of transmitted data ranges from $[0,30]$ MB and does not exceed the total task data size. To simplify the system modeling, we assume that 15 vehicles participate in the auction and that the transmitted portion of the data is considered completed once the transmission is finished; the remaining untransmitted data stays at the edge node for continued execution. Meanwhile, to link the resource auction with task offloading, we further assume a linear relationship between the amount of idle resources to be purchased and the transmitted data size, i.e., $C=k·D$, where C denotes the required resource amount (MHz) and D denotes the transmitted data size (MB). In this experiment, we set $k=1$, treating resource amount and data size as equivalent.

The key metric of this experiment is the end-to-end latency, defined as the sum of the latency of the task offloading module and the data transmission latency of the resource auction module.

Results and analysis: Figure 15 presents the end-to-end latency evaluation results for various combinations of task offloading models and the resource auction module. From the overall trend, it can be observed that the system achieves the best end-to-end latency performance when the proposed task offloading module LA-Trust is combined with the proposed resource auction mechanism DC-RA. Under the conditions that the task size reaches 70 MB and the data volume transmitted from the edge node to the winning vehicles does not exceed 30 MB, the end-to-end latency of this combined scheme remains below 0.3 s. This is because both proposed modules explicitly incorporate data transmission latency into the decision-making process. Whether during the task offloading stage or the data transmission stage after the resource auction is completed, the core optimization objective is to reduce the overall system latency. LA-Trust employs a parallel processing mechanism to allow partial temporal overlap between task transmission and execution, thereby minimizing service delays at the nodes. Meanwhile, DC-RA considers the distances of candidate vehicles in the auction and selects appropriate vehicles by balancing communication latency and resource cost, thus reducing the communication delay between the node and the selected vehicles. Together, this combined scheme effectively reduces the overall system latency.

7.5. End-to-End Privacy Risk Evaluation of the Framework

Under the security assumptions established in Section 4 and Section 5, this section assumes that vehicles may be subject to reconstruction attacks during task offloading. Specifically, the attacker reconstructs the perturbed trajectory and point cloud data using a sliding-window temporal smoothing method and a KNN + PCA-based method, respectively. By comparing the defense performance of different privacy-preserving schemes under identical attack conditions, we evaluate the effectiveness of the proposed privacy protection method in resisting reconstruction attacks.

Settings and experiments: For trajectory reconstruction, we apply a sliding-window temporal smoothing method with window sizes of $\{3,5,7,9\}$ to the perturbed trajectory data, generating four independent reconstruction results. For point cloud reconstruction, we apply the KNN + PCA-based method with five different random seeds $\{29,32,41,44,48\}$ on the perturbed point cloud data, resulting in five independent reconstruction results. The final performance is reported as the mean values across these independent runs, together with the corresponding 95% confidence intervals.

Results and analysis: Figure 16a presents the trajectory reconstruction results. A higher reconstruction rate indicates that the reconstructed trajectory is more similar to the original one, implying weaker privacy protection. The results show that the trajectory reconstruction rate increases with the privacy budget, which is consistent with expectations. In the comparison, the proposed method DA-LDP exhibits similar reconstruction rates to the Xia’s algorithm and the traditional fixed Laplace noise approach, indicating that our method still maintains a certain level of resistance against trajectory reconstruction attacks.

Figure 16b shows the point cloud reconstruction results. A lower CD value indicates that the reconstructed point cloud is closer to the original one, i.e., better reconstruction performance. According to the point cloud reconstruction literature [60], a reconstruction can be considered relatively successful when the CD (multiplied by 100) is below 0.3.

From the experimental results, when the privacy budget $ϵ$ is below 5.75, our method yields slightly lower CD values than the comparison methods under reconstruction attacks, but the values remain relatively high and do not meet the successful reconstruction criterion, indicating that the point cloud still retains strong privacy protection. When $ϵ$ exceeds 5.75, the proposed method and the comparison methods show similar trends and ranges in CD values, suggesting that our method also possesses a certain level of robustness against point cloud reconstruction attacks.

From the above analysis, it can be seen that our method demonstrates reasonable performance in the reconstruction experiments, which is due to the fact that the algorithm always satisfies $({ϵ}_{\mathrm{total}},{\delta }_{\mathrm{total}})$-LDP. Even though the noise intensity is adaptively adjusted based on the data structure, the overall privacy budget is strictly bounded by ${ϵ}_{\mathrm{total}}$, ensuring effective privacy protection. Combined with the task execution accuracy results and their analysis in Figure 8, these findings indicate that the proposed method can improve downstream task performance while maintaining resistance to reconstruction attacks.

8. Conclusions

8.1. Concluding Remarks

In this paper, we propose an integrated framework for high-load task offloading in the IoV environment that jointly reduce task service latency and privacy risks by combining LA-Trust for trustworthy multi-flow offloading, DA-LDP for distribution-aware local differential privacy, and DC-RA for latency-aware resource incentive. Experimental results demonstrate that the proposed algorithms achieve superior performance compared to existing methods.

8.2. Future Work

For the LA-Trust algorithm, future work will focus on enhancing scalability, realism, and robustness in highly dynamic vehicular environments. The current linear mobility assumption will be extended to structured urban road networks using graph-based topology representations extracted from real map data, where intersections and traffic signal states are modeled as stochastic processes. We will construct a more realistic and complex vehicle motion model, incorporating short-term speed predictions, random acceleration and deceleration, and lane-change events, and integrate it into the dwell time prediction to better handle sudden or irregular vehicle behaviors in urban traffic. To strengthen security, comprehensive threat models incorporating coordinated adversarial behaviors and falsified trust reporting will be constructed, and anomaly detection mechanisms will be introduced to filter abnormal actions while quantifying resilience under varying attack intensities. Additionally, game-theoretic models will be explored to capture trust dynamics among nodes, where trust probabilities are updated based on observed behaviors, enabling more automated and adaptive evaluation under general threat scenarios. In addition, controlled stress-testing environments will be developed to simulate abrupt dwell time shrinkage, bursty task arrivals, and high-density workload surges. Specific performance indicators, such as tail latency, task completion rate, and resilience under adversarial actions, will be measured. Extreme scenarios will be generated using stochastic perturbations to vehicle mobility patterns, synthetic bursts in task arrival rates, and injection of coordinated anomalous behaviors, enabling systematic worst-case performance and tail-risk analysis under out-of-distribution conditions. Finally, the scalability and robustness of LA-Trust will be evaluated using high-fidelity, city-scale simulations that integrate microscopic traffic simulators with realistic vehicular flows and edge computing infrastructure, while extending the dual-node strategy to a generalized multi-node framework, by systematically varying environmental factors such as vehicle density and mobility patterns in the experiments to assess the model’s performance, for example, how these factors influence offloading decisions.

For the DA-LDP algorithm, we plan to introduce an adaptive privacy budget allocation mechanism on top of the current dynamic noise scheme, enabling task-specific adjustment of privacy levels based on task importance and protection requirements. In particular, future work will focus on analyzing the sensitivity of tasks in autonomous driving scenarios, investigating how different types of vehicular tasks, such as trajectory prediction, point cloud processing, and sensor fusion, affect privacy risks and protection needs. We will conduct a comprehensive survey of task-level privacy requirements to derive informed thresholds for privacy budgets corresponding to different task categories. These thresholds, together with $k_n$, jointly determine the privacy protection strength. This strategy will be formulated as a joint privacy–utility optimization problem and potentially solved using RL-based budget scheduling. Beyond trajectory and point cloud data, DA-LDP will be extended to accommodate additional types of data inputs, such as camera video streams, potentially by injecting calibrated Gaussian noise into intermediate feature embeddings extracted via lightweight convolutional encoders, allowing quantitative evaluation of the trade-off between visual perception accuracy and privacy protection.

For the DC-RA algorithm, future work will aim to improve resource allocation efficiency and system adaptability in dynamic vehicular environments. Specifically, task priorities, heterogeneous vehicle capacities, and network topology awareness will be incorporated into the auction mechanism to better match supply and demand. Furthermore, multi-dimensional auction designs will be explored to accommodate multiple task requirements beyond latency, such as energy consumption, reliability, and privacy preservation. These metrics will be integrated into the optimization function, and their relative weights can be adjusted to achieve a more general and flexible auction mechanism. To handle vehicle churn, the DC-RA algorithm will be extended to support online, real-time auctions, by using incremental bid processing and candidate vehicle pool updates, allowing edge nodes to dynamically update bids and allocations as vehicles join or leave the network. Additionally, the scalability and robustness of the extended DC-RA algorithm will be evaluated through city-scale simulations with realistic traffic patterns, varying vehicle densities, and stress tests such as sudden task surges and high churn scenarios. Key metrics including average and tail auction latency, system cost sensitivity to vehicle dynamics, and overall robustness will be evaluated. Extreme scenarios will be generated by intensifying system load and supply-demand imbalance, such as injecting large bursts of task submissions, rapidly varying the availability of participating vehicles, and introducing abrupt changes in vehicle density. These conditions will enable systematic evaluation of system stability and worst-case performance under highly volatile and resource-constrained environments.

In addition, for the end-to-end evaluation of the framework, future work will extend the current experiments to more realistic and challenging scenarios. Specifically, we plan to conduct city-scale simulations with realistic traffic flows to evaluate system latency under practical operating conditions, and to employ more sophisticated and stronger attack models to test privacy protection under adversarial scenarios.

Furthermore, cross-domain collaboration among multiple vehicular networks will be investigated to assess the impact of heterogeneous networks on the framework. By examining the diversity of information and resources across different domains, the framework can be further refined to enhance scalability, robustness, and information sharing capabilities. Emerging technologies will also be incorporated, such as applying dynamic privacy-preserving mechanisms to federated learning for distributed model training, and leveraging digital twins to generate synthetic training data under diverse traffic and network conditions, as well as to conduct real-time strategy simulations. Finally, if experimental conditions permit, the framework will be evaluated in real-world road environments to measure its performance under live traffic and network scenarios.

Through these efforts, we aim to further enhance the efficiency, robustness, and adaptability of the system.